Edit tour

Linux Analysis Report
zmap.mips.elf

Overview

General Information

Sample name:	zmap.mips.elf
Analysis ID:	1582190
MD5:	8851f74b1bf422061873a82d50b040ef
SHA1:	65f83258e1058b764eddba03bd272cc53eda279e
SHA256:	9c240e36edad591b42b8afd15173d5b8e20be97a4dc2890e40726ba930b069ba
Tags:	elfMiraiuser-abuse_ch
Infos:

Detection

Mirai, Okiru

Score:	84
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Yara detected Okiru

Sample deletes itself

Detected TCP or UDP traffic on non-standard ports

Sample has stripped symbol table

Sample listens on a socket

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582190
Start date and time:	2024-12-30 03:43:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	zmap.mips.elf
Detection:	MAL
Classification:	mal84.troj.evad.linELF@0/0@59/0

Runtime Messages

Command:	/tmp/zmap.mips.elf
PID:	5552
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	VagneRHere
Standard Error:

Process Tree

system is lnxubuntu20

zmap.mips.elf (PID: 5552, Parent: 5467, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/zmap.mips.elf

zmap.mips.elf New Fork (PID: 5554, Parent: 5552)

zmap.mips.elf New Fork (PID: 5556, Parent: 5554)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
zmap.mips.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
zmap.mips.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
zmap.mips.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x141d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1420c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1425c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1434c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5552.1.00007f54c4400000.00007f54c4417000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5552.1.00007f54c4400000.00007f54c4417000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5552.1.00007f54c4400000.00007f54c4417000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x141d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1420c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1425c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1434c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5556.1.00007f54c4400000.00007f54c4417000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5556.1.00007f54c4400000.00007f54c4417000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5556.1.00007f54c4400000.00007f54c4417000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x141d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1420c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1425c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1434c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: zmap.mips.elf PID: 5552	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: zmap.mips.elf PID: 5552	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: zmap.mips.elf PID: 5552	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x5ff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x601c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6030:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6044:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x606c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x610c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6120:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6134:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6148:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x615c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6170:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6184:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: zmap.mips.elf PID: 5556	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: zmap.mips.elf PID: 5556	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: zmap.mips.elf PID: 5556	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4116:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x412a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x413e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4152:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4166:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x417a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x418e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41de:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4206:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x421a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x422e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4242:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4256:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x426a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x427e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4292:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 7 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: zmap.mips.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: zmap.mips.elf	ReversingLabs: Detection: 57%
Source: zmap.mips.elf	Virustotal: Detection: 61%			Perma Link

Source: global traffic

TCP traffic: 192.168.2.14:35334 -> 185.196.8.105:59962

Source: /tmp/zmap.mips.elf (PID: 5552)

Socket: 127.0.0.1:39148

Jump to behavior

Source: global traffic

DNS traffic detected: DNS query: srvy.vlrt-gap.com

System Summary

Malicious sample detected (through community Yara rule)

Source: zmap.mips.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5552.1.00007f54c4400000.00007f54c4417000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5556.1.00007f54c4400000.00007f54c4417000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: zmap.mips.elf PID: 5552, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: zmap.mips.elf PID: 5556, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: ELF static info symbol of initial sample

.symtab present: no

Source: zmap.mips.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5552.1.00007f54c4400000.00007f54c4417000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5556.1.00007f54c4400000.00007f54c4417000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: zmap.mips.elf PID: 5552, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: zmap.mips.elf PID: 5556, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal84.troj.evad.linELF@0/0@59/0

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/zmap.mips.elf (PID: 5552)

File: /tmp/zmap.mips.elf

Jump to behavior

Source: /tmp/zmap.mips.elf (PID: 5552)

Queries kernel information via 'uname':

Jump to behavior

Source: zmap.mips.elf, 5552.1.00005649569b5000.0000564956a3c000.rw-.sdmp, zmap.mips.elf, 5556.1.00005649569b5000.0000564956a3c000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: zmap.mips.elf, 5552.1.00007fff2e596000.00007fff2e5b7000.rw-.sdmp, zmap.mips.elf, 5556.1.00007fff2e596000.00007fff2e5b7000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips
Source: zmap.mips.elf, 5552.1.00007fff2e596000.00007fff2e5b7000.rw-.sdmp, zmap.mips.elf, 5556.1.00007fff2e596000.00007fff2e5b7000.rw-.sdmp	Binary or memory string: NJx86_64/usr/bin/qemu-mips/tmp/zmap.mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/zmap.mips.elf
Source: zmap.mips.elf, 5552.1.00005649569b5000.0000564956a3c000.rw-.sdmp, zmap.mips.elf, 5556.1.00005649569b5000.0000564956a3c000.rw-.sdmp	Binary or memory string: VIV!/etc/qemu-binfmt/mips

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: zmap.mips.elf, type: SAMPLE
Source: Yara match	File source: 5552.1.00007f54c4400000.00007f54c4417000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5556.1.00007f54c4400000.00007f54c4417000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zmap.mips.elf PID: 5552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: zmap.mips.elf PID: 5556, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: zmap.mips.elf, type: SAMPLE
Source: Yara match	File source: 5552.1.00007f54c4400000.00007f54c4417000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5556.1.00007f54c4400000.00007f54c4417000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zmap.mips.elf PID: 5552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: zmap.mips.elf PID: 5556, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: zmap.mips.elf, type: SAMPLE
Source: Yara match	File source: 5552.1.00007f54c4400000.00007f54c4417000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5556.1.00007f54c4400000.00007f54c4417000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zmap.mips.elf PID: 5552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: zmap.mips.elf PID: 5556, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: zmap.mips.elf, type: SAMPLE
Source: Yara match	File source: 5552.1.00007f54c4400000.00007f54c4417000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5556.1.00007f54c4400000.00007f54c4417000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zmap.mips.elf PID: 5552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: zmap.mips.elf PID: 5556, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
zmap.mips.elf	58%	ReversingLabs	Linux.Trojan.Mirai
zmap.mips.elf	62%	Virustotal		Browse
zmap.mips.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
srvy.vlrt-gap.com	185.196.8.105	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.196.8.105	srvy.vlrt-gap.com	Switzerland		34888	SIMPLECARRER2IT	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.196.8.105	zmap.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse
	zmap.m68k.elf	Get hash	malicious	Mirai, Okiru	Browse
	zmap.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse
	zmap.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse
	zmap.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse
	zmap.spc.elf	Get hash	malicious	Mirai, Okiru	Browse
	zmap.x86.elf	Get hash	malicious	Okiru	Browse
	zmap.arm.elf	Get hash	malicious	Mirai, Okiru	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
srvy.vlrt-gap.com	zmap.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105
	zmap.m68k.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105
	zmap.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105
	zmap.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105
	zmap.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105
	zmap.spc.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105
	zmap.x86.elf	Get hash	malicious	Okiru	Browse	185.196.8.105
	zmap.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SIMPLECARRER2IT	zmap.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105
	zmap.m68k.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105
	0A7XTINw3R.exe	Get hash	malicious	Unknown	Browse	185.196.8.218
	zmap.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105
	zmap.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105
	zmap.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105
	zmap.spc.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105
	zmap.x86.elf	Get hash	malicious	Okiru	Browse	185.196.8.105
	zmap.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105
	DQmU06kq9I.exe	Get hash	malicious	LiteHTTP Bot	Browse	185.208.159.109

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.484822702462792
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	zmap.mips.elf
File size:	97'100 bytes
MD5:	8851f74b1bf422061873a82d50b040ef
SHA1:	65f83258e1058b764eddba03bd272cc53eda279e
SHA256:	9c240e36edad591b42b8afd15173d5b8e20be97a4dc2890e40726ba930b069ba
SHA512:	2b01e596795be06c56dac4d55dd504f5ce14cc4a6eb2d4bce26e1c511df602c13eb8284e27b9cab58a96b203e7c4c9428cba628953b75911898530ed4daec3a7
SSDEEP:	1536:mF4tsbv54o+3bPhXhWxZJWNTUpuD+fyecpeo6XFLJy:mF4tsr54o+rPhkxYTUpuD+fyecIXFLM
TLSH:	5293940E7E268F7DFBA9823447B78E22674833D637D0D585D19CE6012E6028E241FFA5
File Content Preview:	.ELF.....................@.`...4..yD.....4. ...(.............@...@....c...c...............p..Ep..Ep.......-.........dt.Q............................<...'..\...!'.......................<...'..8...!... ....'9... ......................<...'......!........'9@

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	96580
Section Header Size:	40
Number of Section Headers:	13
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x14040	0x0	0x6	AX	16
.fini	PROGBITS	0x414160	0x14160	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x4141c0	0x141c0	0x21e0	0x0	0x2	A	16
.ctors	PROGBITS	0x457000	0x17000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x457008	0x17008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x457020	0x17020	0x3e0	0x0	0x3	WA	16
.got	PROGBITS	0x457400	0x17400	0x4ec	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x4578ec	0x178ec	0x1c	0x0	0x10000003	WAp	4
.bss	NOBITS	0x457910	0x178ec	0x23f8	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x9a2	0x178ec	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x178ec	0x57	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x163a0	0x163a0	5.6368	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x17000	0x457000	0x457000	0x8ec	0x2d08	3.7571	0x6	RW	0x10000	.ctors .dtors .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 03:44:17.046113014 CET	35334	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:17.050909996 CET	59962	35334	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:17.050956011 CET	35334	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:17.053740978 CET	35334	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:17.058546066 CET	59962	35334	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:17.058646917 CET	35334	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:17.063472033 CET	59962	35334	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:17.703759909 CET	59962	35334	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:17.703896999 CET	35334	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:17.704037905 CET	35334	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:17.712614059 CET	35336	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:17.717466116 CET	59962	35336	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:17.717538118 CET	35336	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:17.718552113 CET	35336	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:17.723408937 CET	59962	35336	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:17.723474979 CET	35336	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:17.728303909 CET	59962	35336	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:18.346393108 CET	59962	35336	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:18.346524954 CET	35336	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:18.346617937 CET	35336	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:18.354728937 CET	35338	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:18.359628916 CET	59962	35338	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:18.359730959 CET	35338	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:18.360586882 CET	35338	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:18.365443945 CET	59962	35338	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:18.365502119 CET	35338	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:18.370362997 CET	59962	35338	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:18.985368967 CET	59962	35338	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:18.985508919 CET	35338	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:18.985547066 CET	35338	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:18.993880033 CET	35340	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:18.998658895 CET	59962	35340	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:18.998735905 CET	35340	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:18.999429941 CET	35340	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:19.004247904 CET	59962	35340	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:19.004286051 CET	35340	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:19.009123087 CET	59962	35340	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:19.617552042 CET	59962	35340	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:19.617765903 CET	35340	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:19.617841005 CET	35340	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:19.625519037 CET	35342	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:19.630394936 CET	59962	35342	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:19.630464077 CET	35342	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:19.631118059 CET	35342	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:19.635941029 CET	59962	35342	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:19.635993004 CET	35342	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:19.640818119 CET	59962	35342	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:20.262828112 CET	59962	35342	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:20.263014078 CET	35342	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:20.263046026 CET	35342	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:20.271296024 CET	35344	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:20.276082993 CET	59962	35344	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:20.276149035 CET	35344	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:20.276832104 CET	35344	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:20.281691074 CET	59962	35344	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:20.281738043 CET	35344	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:20.286544085 CET	59962	35344	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:20.897869110 CET	59962	35344	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:20.898025990 CET	35344	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:20.898070097 CET	35344	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:20.906642914 CET	35346	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:20.911536932 CET	59962	35346	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:20.911607981 CET	35346	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:20.912431002 CET	35346	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:20.917253971 CET	59962	35346	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:20.917308092 CET	35346	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:20.922090054 CET	59962	35346	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:21.536353111 CET	59962	35346	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:21.536628008 CET	35346	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:21.536660910 CET	35346	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:21.545726061 CET	35348	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:21.550709963 CET	59962	35348	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:21.550785065 CET	35348	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:21.551490068 CET	35348	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:21.556315899 CET	59962	35348	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:21.556359053 CET	35348	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:21.561379910 CET	59962	35348	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:22.173827887 CET	59962	35348	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:22.173947096 CET	35348	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:22.174000025 CET	35348	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:22.182324886 CET	35350	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:22.187230110 CET	59962	35350	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:22.187306881 CET	35350	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:22.187967062 CET	35350	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:22.192830086 CET	59962	35350	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:22.192893982 CET	35350	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:22.197705984 CET	59962	35350	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:22.813127995 CET	59962	35350	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:22.813349962 CET	35350	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:22.813349962 CET	35350	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:22.822114944 CET	35352	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:22.826977015 CET	59962	35352	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:22.827042103 CET	35352	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:22.827842951 CET	35352	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:22.832667112 CET	59962	35352	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:22.832736015 CET	35352	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:22.837457895 CET	59962	35352	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:23.467624903 CET	59962	35352	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:23.467780113 CET	35352	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:23.467780113 CET	35352	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:23.476746082 CET	35354	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:23.481578112 CET	59962	35354	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:23.481662989 CET	35354	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:23.482616901 CET	35354	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:23.487454891 CET	59962	35354	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:23.487509012 CET	35354	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:23.492383957 CET	59962	35354	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:24.116384029 CET	59962	35354	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:24.116657972 CET	35354	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:24.116657972 CET	35354	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:24.124614954 CET	35356	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:24.129549980 CET	59962	35356	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:24.129627943 CET	35356	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:24.130371094 CET	35356	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:24.135202885 CET	59962	35356	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:24.135248899 CET	35356	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:24.140225887 CET	59962	35356	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:24.747576952 CET	59962	35356	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:24.747720957 CET	35356	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:24.747766972 CET	35356	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:24.755649090 CET	35358	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:24.760509014 CET	59962	35358	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:24.760567904 CET	35358	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:24.761423111 CET	35358	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:24.766239882 CET	59962	35358	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:24.766283035 CET	35358	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:24.771071911 CET	59962	35358	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:25.381910086 CET	59962	35358	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:25.382049084 CET	35358	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:25.382076025 CET	35358	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:25.390305996 CET	35360	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:25.395117044 CET	59962	35360	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:25.395174980 CET	35360	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:25.395840883 CET	35360	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:25.400584936 CET	59962	35360	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:25.400628090 CET	35360	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:25.405397892 CET	59962	35360	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:26.016594887 CET	59962	35360	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:26.016850948 CET	35360	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:26.017314911 CET	35360	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:26.026618958 CET	35362	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:26.031759024 CET	59962	35362	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:26.031840086 CET	35362	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:26.032974958 CET	35362	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:26.037847996 CET	59962	35362	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:26.037915945 CET	35362	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:26.042793036 CET	59962	35362	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:26.667900085 CET	59962	35362	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:26.668207884 CET	35362	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:26.668207884 CET	35362	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:26.676834106 CET	35364	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:26.681615114 CET	59962	35364	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:26.681680918 CET	35364	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:26.682827950 CET	35364	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:26.687629938 CET	59962	35364	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:26.687689066 CET	35364	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:26.692471981 CET	59962	35364	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:27.302851915 CET	59962	35364	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:27.302954912 CET	35364	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:27.303193092 CET	35364	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:27.311683893 CET	35366	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:27.316489935 CET	59962	35366	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:27.316566944 CET	35366	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:27.317717075 CET	35366	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:27.322541952 CET	59962	35366	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:27.322626114 CET	35366	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:27.327425003 CET	59962	35366	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:27.938163042 CET	59962	35366	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:27.938348055 CET	35366	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:27.938450098 CET	35366	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:27.946947098 CET	35368	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:27.951700926 CET	59962	35368	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:27.951761007 CET	35368	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:27.952636957 CET	35368	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:27.957370043 CET	59962	35368	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:27.957436085 CET	35368	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:27.962255955 CET	59962	35368	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:28.605262995 CET	59962	35368	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:28.605407953 CET	35368	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:28.605638027 CET	35368	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:28.615598917 CET	35370	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:28.620455980 CET	59962	35370	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:28.620541096 CET	35370	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:28.621433020 CET	35370	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:28.626260042 CET	59962	35370	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:28.626328945 CET	35370	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:28.631084919 CET	59962	35370	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:29.261367083 CET	59962	35370	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:29.261693001 CET	35370	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:29.261799097 CET	35370	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:29.270596027 CET	35372	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:29.275444984 CET	59962	35372	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:29.275511026 CET	35372	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:29.276336908 CET	35372	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:29.281166077 CET	59962	35372	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:29.281209946 CET	35372	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:29.286061049 CET	59962	35372	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:29.909603119 CET	59962	35372	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:29.909759998 CET	35372	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:29.909781933 CET	35372	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:29.918904066 CET	35374	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:29.923731089 CET	59962	35374	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:29.923796892 CET	35374	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:29.925024033 CET	35374	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:29.929825068 CET	59962	35374	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:29.929887056 CET	35374	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:29.934736967 CET	59962	35374	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:30.570780039 CET	59962	35374	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:30.570911884 CET	35374	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:30.570966005 CET	35374	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:30.579587936 CET	35376	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:30.584471941 CET	59962	35376	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:30.584547997 CET	35376	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:30.585465908 CET	35376	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:30.590277910 CET	59962	35376	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:30.590357065 CET	35376	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:30.595232010 CET	59962	35376	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:31.212513924 CET	59962	35376	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:31.212810040 CET	35376	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:31.212960958 CET	35376	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:31.221535921 CET	35378	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:31.226301908 CET	59962	35378	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:31.226357937 CET	35378	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:31.227298021 CET	35378	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:31.232055902 CET	59962	35378	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:31.232103109 CET	35378	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:31.236869097 CET	59962	35378	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:31.851402044 CET	59962	35378	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:31.851514101 CET	35378	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:31.851651907 CET	35378	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:31.860621929 CET	35380	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:31.865372896 CET	59962	35380	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:31.865442038 CET	35380	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:31.866528034 CET	35380	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:31.871284962 CET	59962	35380	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:31.871342897 CET	35380	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:31.876123905 CET	59962	35380	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:32.517911911 CET	59962	35380	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:32.518208981 CET	35380	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:32.518351078 CET	35380	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:32.526840925 CET	35382	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:32.531677008 CET	59962	35382	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:32.531742096 CET	35382	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:32.532933950 CET	35382	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:32.537729979 CET	59962	35382	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:32.537781000 CET	35382	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:32.542567968 CET	59962	35382	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:33.176966906 CET	59962	35382	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:33.177093983 CET	35382	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:33.177197933 CET	35382	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:33.186285019 CET	35384	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:33.191082001 CET	59962	35384	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:33.191164017 CET	35384	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:33.192132950 CET	35384	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:33.196894884 CET	59962	35384	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:33.196952105 CET	35384	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:33.202081919 CET	59962	35384	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:33.834892035 CET	59962	35384	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:33.835215092 CET	35384	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:33.835316896 CET	35384	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:33.844130993 CET	35386	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:33.848893881 CET	59962	35386	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:33.848978043 CET	35386	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:33.850097895 CET	35386	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:33.854842901 CET	59962	35386	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:33.854906082 CET	35386	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:33.859750032 CET	59962	35386	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:34.476114988 CET	59962	35386	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:34.476530075 CET	35386	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:34.476561069 CET	35386	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:34.485873938 CET	35388	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:34.490685940 CET	59962	35388	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:34.490760088 CET	35388	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:34.491965055 CET	35388	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:34.496779919 CET	59962	35388	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:34.496835947 CET	35388	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:34.501667023 CET	59962	35388	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:35.112698078 CET	59962	35388	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:35.113004923 CET	35388	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:35.113137960 CET	35388	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:35.122483969 CET	35390	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:35.127315998 CET	59962	35390	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:35.127396107 CET	35390	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:35.128654957 CET	35390	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:35.133480072 CET	59962	35390	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:35.133538008 CET	35390	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:35.138367891 CET	59962	35390	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:35.762336969 CET	59962	35390	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:35.762481928 CET	35390	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:35.762522936 CET	35390	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:35.771173000 CET	35392	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:35.776470900 CET	59962	35392	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:35.776556969 CET	35392	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:35.777744055 CET	35392	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:35.782578945 CET	59962	35392	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:35.782629967 CET	35392	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:35.787492037 CET	59962	35392	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:36.414453030 CET	59962	35392	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:36.414572954 CET	35392	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:36.414828062 CET	35392	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:36.424173117 CET	35394	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:36.429079056 CET	59962	35394	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:36.429153919 CET	35394	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:36.430023909 CET	35394	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:36.434823036 CET	59962	35394	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:36.434883118 CET	35394	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:36.439690113 CET	59962	35394	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:37.056447029 CET	59962	35394	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:37.056721926 CET	35394	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:37.056721926 CET	35394	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:37.064766884 CET	35396	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:37.069617033 CET	59962	35396	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:37.069677114 CET	35396	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:37.070437908 CET	35396	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:37.075191021 CET	59962	35396	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:37.075237989 CET	35396	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:37.080056906 CET	59962	35396	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:37.692241907 CET	59962	35396	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:37.692584038 CET	35396	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:37.692784071 CET	35396	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:37.702120066 CET	35398	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:37.706958055 CET	59962	35398	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:37.707041025 CET	35398	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:37.708348989 CET	35398	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:37.713107109 CET	59962	35398	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:37.713198900 CET	35398	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:37.718015909 CET	59962	35398	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:38.341865063 CET	59962	35398	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:38.342233896 CET	35398	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:38.342364073 CET	35398	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:38.351686001 CET	35400	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:38.356555939 CET	59962	35400	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:38.356643915 CET	35400	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:38.357719898 CET	35400	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:38.362473965 CET	59962	35400	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:38.362562895 CET	35400	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:38.367434025 CET	59962	35400	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:38.993626118 CET	59962	35400	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:38.993771076 CET	35400	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:38.993995905 CET	35400	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:39.001993895 CET	35402	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:39.007042885 CET	59962	35402	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:39.007119894 CET	35402	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:39.008055925 CET	35402	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:39.012830019 CET	59962	35402	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:39.012891054 CET	35402	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:39.017786980 CET	59962	35402	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:39.624749899 CET	59962	35402	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:39.625071049 CET	35402	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:39.625170946 CET	35402	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:39.633235931 CET	35404	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:39.638087034 CET	59962	35404	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:39.638142109 CET	35404	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:39.639097929 CET	35404	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:39.643903017 CET	59962	35404	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:39.643949986 CET	35404	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:39.648797989 CET	59962	35404	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:40.271732092 CET	59962	35404	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:40.271924973 CET	35404	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:40.271996021 CET	35404	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:40.280329943 CET	35406	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:40.285154104 CET	59962	35406	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:40.285229921 CET	35406	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:40.286139011 CET	35406	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:40.290965080 CET	59962	35406	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:40.291032076 CET	35406	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:40.295875072 CET	59962	35406	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:40.906438112 CET	59962	35406	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:40.906572104 CET	35406	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:40.906622887 CET	35406	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:40.915276051 CET	35408	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:40.920104027 CET	59962	35408	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:40.920161009 CET	35408	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:40.920835018 CET	35408	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:40.925678015 CET	59962	35408	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:40.925726891 CET	35408	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:40.930465937 CET	59962	35408	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:41.542637110 CET	59962	35408	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:41.542993069 CET	35408	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:41.543128967 CET	35408	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:41.552247047 CET	35410	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:41.557106018 CET	59962	35410	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:41.557173967 CET	35410	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:41.558094978 CET	35410	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:41.562987089 CET	59962	35410	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:41.563056946 CET	35410	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:41.567914009 CET	59962	35410	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:42.195931911 CET	59962	35410	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:42.196191072 CET	35410	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:42.196191072 CET	35410	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:42.205075026 CET	35412	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:42.209949017 CET	59962	35412	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:42.210025072 CET	35412	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:42.211002111 CET	35412	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:42.215816975 CET	59962	35412	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:42.215882063 CET	35412	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:42.220673084 CET	59962	35412	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:42.840691090 CET	59962	35412	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:42.840989113 CET	35412	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:42.840989113 CET	35412	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:42.848959923 CET	35414	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:42.853878021 CET	59962	35414	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:42.853936911 CET	35414	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:42.854788065 CET	35414	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:42.859595060 CET	59962	35414	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:42.859652996 CET	35414	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:42.864487886 CET	59962	35414	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:43.496761084 CET	59962	35414	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:43.497108936 CET	35414	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:43.497152090 CET	35414	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:43.505325079 CET	35416	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:43.510174036 CET	59962	35416	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:43.510227919 CET	35416	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:43.510911942 CET	35416	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:43.515718937 CET	59962	35416	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:43.515763998 CET	35416	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:43.520592928 CET	59962	35416	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:44.131504059 CET	59962	35416	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:44.131623030 CET	35416	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:44.131676912 CET	35416	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:44.139708996 CET	35418	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:44.144531965 CET	59962	35418	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:44.144591093 CET	35418	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:44.145159006 CET	35418	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:44.149923086 CET	59962	35418	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:44.149966002 CET	35418	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:44.154782057 CET	59962	35418	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:44.769675970 CET	59962	35418	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:44.770030022 CET	35418	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:44.770072937 CET	35418	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:44.778367996 CET	35420	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:44.783272028 CET	59962	35420	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:44.783380985 CET	35420	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:44.784434080 CET	35420	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:44.789356947 CET	59962	35420	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:44.789418936 CET	35420	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:44.794363022 CET	59962	35420	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:45.409534931 CET	59962	35420	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:45.409801960 CET	35420	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:45.409868956 CET	35420	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:45.417853117 CET	35422	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:45.422718048 CET	59962	35422	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:45.422792912 CET	35422	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:45.423435926 CET	35422	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:45.428303003 CET	59962	35422	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:45.428374052 CET	35422	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:45.433290005 CET	59962	35422	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:46.053442955 CET	59962	35422	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:46.053567886 CET	35422	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:46.053694963 CET	35422	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:46.061300993 CET	35424	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:46.066128016 CET	59962	35424	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:46.066184998 CET	35424	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:46.066768885 CET	35424	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:46.071562052 CET	59962	35424	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:46.071609020 CET	35424	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:46.076430082 CET	59962	35424	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:46.710972071 CET	59962	35424	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:46.711213112 CET	35424	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:46.711368084 CET	35424	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:46.719078064 CET	35426	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:46.723897934 CET	59962	35426	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:46.723965883 CET	35426	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:46.724586964 CET	35426	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:46.729387999 CET	59962	35426	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:46.729440928 CET	35426	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:46.734289885 CET	59962	35426	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:47.359261990 CET	59962	35426	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:47.359554052 CET	35426	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:47.359554052 CET	35426	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:47.367609024 CET	35428	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:47.372504950 CET	59962	35428	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:47.372608900 CET	35428	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:47.373219967 CET	35428	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:47.377989054 CET	59962	35428	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:47.378031969 CET	35428	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:47.382850885 CET	59962	35428	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:48.001152039 CET	59962	35428	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:48.001295090 CET	35428	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:48.001432896 CET	35428	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:48.009111881 CET	35430	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:48.013993025 CET	59962	35430	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:48.014051914 CET	35430	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:48.014740944 CET	35430	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:48.019551992 CET	59962	35430	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:48.019604921 CET	35430	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:48.024457932 CET	59962	35430	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:48.660419941 CET	59962	35430	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:48.660666943 CET	35430	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:48.660715103 CET	35430	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:48.669734955 CET	35432	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:48.674626112 CET	59962	35432	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:48.674716949 CET	35432	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:48.675489902 CET	35432	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:48.680306911 CET	59962	35432	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:48.680375099 CET	35432	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:48.685247898 CET	59962	35432	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:49.321460962 CET	59962	35432	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:49.321907997 CET	35432	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:49.321907997 CET	35432	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:49.330894947 CET	35434	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:49.335746050 CET	59962	35434	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:49.335808992 CET	35434	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:49.336545944 CET	35434	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:49.342171907 CET	59962	35434	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:49.342226982 CET	35434	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:49.347826004 CET	59962	35434	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:49.960432053 CET	59962	35434	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:49.960541010 CET	35434	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:49.960570097 CET	35434	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:49.969176054 CET	35436	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:49.974050045 CET	59962	35436	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:49.974114895 CET	35436	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:49.974757910 CET	35436	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:49.979574919 CET	59962	35436	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:49.979626894 CET	35436	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:49.984421015 CET	59962	35436	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:50.601139069 CET	59962	35436	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:50.601465940 CET	35436	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:50.601495028 CET	35436	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:50.609966993 CET	35438	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:50.614872932 CET	59962	35438	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:50.614933968 CET	35438	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:50.615650892 CET	35438	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:50.620547056 CET	59962	35438	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:50.620609045 CET	35438	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:50.625524044 CET	59962	35438	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:51.249639988 CET	59962	35438	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:51.249814034 CET	35438	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:51.249903917 CET	35438	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:51.258255005 CET	35440	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:51.263226986 CET	59962	35440	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:51.263299942 CET	35440	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:51.264290094 CET	35440	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:51.269110918 CET	59962	35440	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:51.269180059 CET	35440	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:51.274077892 CET	59962	35440	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:51.881967068 CET	59962	35440	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:51.882230997 CET	35440	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:51.882298946 CET	35440	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:51.891310930 CET	35442	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:51.896198988 CET	59962	35442	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:51.896270990 CET	35442	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:51.896965027 CET	35442	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:51.901839972 CET	59962	35442	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:51.901896954 CET	35442	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:51.906790018 CET	59962	35442	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:52.546533108 CET	59962	35442	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:52.546753883 CET	35442	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:52.546958923 CET	35442	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:52.555444002 CET	35444	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:52.560327053 CET	59962	35444	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:52.560405970 CET	35444	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:52.561372042 CET	35444	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:52.566255093 CET	59962	35444	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:52.566318035 CET	35444	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:52.571212053 CET	59962	35444	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:53.179100037 CET	59962	35444	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:53.179229975 CET	35444	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:53.179297924 CET	35444	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:53.188417912 CET	35446	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:53.193279028 CET	59962	35446	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:53.193337917 CET	35446	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:53.193991899 CET	35446	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:53.198769093 CET	59962	35446	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:53.198807955 CET	35446	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:53.203561068 CET	59962	35446	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:53.819497108 CET	59962	35446	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:53.819828987 CET	35446	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:53.819973946 CET	35446	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:53.829240084 CET	35448	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:53.834167957 CET	59962	35448	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:53.834252119 CET	35448	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:53.835202932 CET	35448	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:53.840066910 CET	59962	35448	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:53.840163946 CET	35448	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:53.845057964 CET	59962	35448	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:54.463581085 CET	59962	35448	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:54.463784933 CET	35448	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:54.463785887 CET	35448	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:54.472212076 CET	35450	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:54.477101088 CET	59962	35450	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:54.477171898 CET	35450	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:54.477772951 CET	35450	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:54.482610941 CET	59962	35450	185.196.8.105	192.168.2.14
Dec 30, 2024 03:44:54.482685089 CET	35450	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:44:54.487466097 CET	59962	35450	185.196.8.105	192.168.2.14
Dec 30, 2024 03:45:04.483851910 CET	35450	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:45:04.488996029 CET	59962	35450	185.196.8.105	192.168.2.14
Dec 30, 2024 03:45:04.672915936 CET	59962	35450	185.196.8.105	192.168.2.14
Dec 30, 2024 03:45:04.673023939 CET	35450	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:46:04.729715109 CET	35450	59962	192.168.2.14	185.196.8.105
Dec 30, 2024 03:46:04.734622002 CET	59962	35450	185.196.8.105	192.168.2.14
Dec 30, 2024 03:46:04.918972969 CET	59962	35450	185.196.8.105	192.168.2.14
Dec 30, 2024 03:46:04.919145107 CET	35450	59962	192.168.2.14	185.196.8.105

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 03:44:17.025126934 CET	37333	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:17.032291889 CET	53	37333	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:17.705137968 CET	47010	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:17.711942911 CET	53	47010	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:18.347845078 CET	60236	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:18.354156971 CET	53	60236	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:18.986490965 CET	55155	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:18.993520021 CET	53	55155	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:19.618788004 CET	39184	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:19.625124931 CET	53	39184	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:20.264014006 CET	33445	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:20.270910025 CET	53	33445	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:20.899218082 CET	37086	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:20.906148911 CET	53	37086	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:21.537611008 CET	55876	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:21.545228004 CET	53	55876	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:22.175024986 CET	51151	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:22.181895018 CET	53	51151	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:22.814341068 CET	45823	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:22.821655989 CET	53	45823	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:23.469280958 CET	42439	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:23.476223946 CET	53	42439	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:24.117614985 CET	44343	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:24.124214888 CET	53	44343	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:24.749018908 CET	33892	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:24.755225897 CET	53	33892	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:25.383100986 CET	58851	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:25.389918089 CET	53	58851	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:26.018948078 CET	50477	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:26.026046038 CET	53	50477	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:26.669852018 CET	50304	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:26.676156998 CET	53	50304	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:27.304337025 CET	43319	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:27.311152935 CET	53	43319	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:27.939636946 CET	35133	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:27.946471930 CET	53	35133	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:28.606810093 CET	55645	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:28.615058899 CET	53	55645	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:29.263103962 CET	57633	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:29.270075083 CET	53	57633	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:29.911310911 CET	47759	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:29.918132067 CET	53	47759	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:30.572480917 CET	59862	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:30.579032898 CET	53	59862	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:31.214277029 CET	36592	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:31.221029043 CET	53	36592	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:31.852891922 CET	46139	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:31.860100985 CET	53	46139	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:32.519996881 CET	49752	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:32.526189089 CET	53	49752	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:33.178396940 CET	50129	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:33.185724974 CET	53	50129	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:33.836755991 CET	60910	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:33.843513012 CET	53	60910	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:34.478250980 CET	50793	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:34.485212088 CET	53	50793	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:35.114765882 CET	33351	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:35.121846914 CET	53	33351	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:35.763968945 CET	46470	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:35.770649910 CET	53	46470	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:36.416230917 CET	56936	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:36.423521042 CET	53	56936	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:37.057840109 CET	36072	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:37.064402103 CET	53	36072	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:37.694319963 CET	38160	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:37.701452017 CET	53	38160	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:38.343728065 CET	34453	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:38.351108074 CET	53	34453	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:38.995170116 CET	48444	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:39.001427889 CET	53	48444	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:39.626385927 CET	55305	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:39.632736921 CET	53	55305	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:40.273195028 CET	59380	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:40.279686928 CET	53	59380	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:40.907769918 CET	46452	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:40.914836884 CET	53	46452	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:41.544929981 CET	46090	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:41.551594019 CET	53	46090	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:42.197418928 CET	43756	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:42.204499960 CET	53	43756	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:42.841742992 CET	45742	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:42.848495960 CET	53	45742	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:43.498089075 CET	59605	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:43.504971981 CET	53	59605	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:44.132647038 CET	52101	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:44.139354944 CET	53	52101	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:44.771228075 CET	43214	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:44.777731895 CET	53	43214	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:45.410984039 CET	50066	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:45.417448997 CET	53	50066	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:46.054805040 CET	59437	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:46.060954094 CET	53	59437	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:46.712318897 CET	43008	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:46.718705893 CET	53	43008	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:47.360369921 CET	40079	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:47.367224932 CET	53	40079	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:48.002317905 CET	59658	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:48.008738041 CET	53	59658	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:48.661765099 CET	35553	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:48.668950081 CET	53	35553	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:49.323101044 CET	40768	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:49.330452919 CET	53	40768	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:49.961824894 CET	57420	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:49.968764067 CET	53	57420	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:50.602551937 CET	56519	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:50.609551907 CET	53	56519	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:51.251276970 CET	43283	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:51.257719994 CET	53	43283	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:51.883662939 CET	34862	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:51.890558004 CET	53	34862	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:52.548401117 CET	47358	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:52.554872036 CET	53	47358	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:53.180397987 CET	57202	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:53.188024044 CET	53	57202	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:53.821234941 CET	57066	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:53.828768015 CET	53	57066	8.8.8.8	192.168.2.14
Dec 30, 2024 03:44:54.464950085 CET	37037	53	192.168.2.14	8.8.8.8
Dec 30, 2024 03:44:54.471847057 CET	53	37037	8.8.8.8	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 30, 2024 03:44:17.025126934 CET	192.168.2.14	8.8.8.8	0x3562	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:17.705137968 CET	192.168.2.14	8.8.8.8	0x71cc	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:18.347845078 CET	192.168.2.14	8.8.8.8	0x7800	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:18.986490965 CET	192.168.2.14	8.8.8.8	0x8bc2	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:19.618788004 CET	192.168.2.14	8.8.8.8	0xe4b8	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:20.264014006 CET	192.168.2.14	8.8.8.8	0x3b9	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:20.899218082 CET	192.168.2.14	8.8.8.8	0x85c7	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:21.537611008 CET	192.168.2.14	8.8.8.8	0x2d60	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:22.175024986 CET	192.168.2.14	8.8.8.8	0x3226	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:22.814341068 CET	192.168.2.14	8.8.8.8	0x2ee4	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:23.469280958 CET	192.168.2.14	8.8.8.8	0x220c	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:24.117614985 CET	192.168.2.14	8.8.8.8	0xb9ac	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:24.749018908 CET	192.168.2.14	8.8.8.8	0x6928	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:25.383100986 CET	192.168.2.14	8.8.8.8	0xe8a3	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:26.018948078 CET	192.168.2.14	8.8.8.8	0xa111	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:26.669852018 CET	192.168.2.14	8.8.8.8	0x5b46	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:27.304337025 CET	192.168.2.14	8.8.8.8	0x4b8b	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:27.939636946 CET	192.168.2.14	8.8.8.8	0x9ae3	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:28.606810093 CET	192.168.2.14	8.8.8.8	0xc7a8	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:29.263103962 CET	192.168.2.14	8.8.8.8	0xf036	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:29.911310911 CET	192.168.2.14	8.8.8.8	0x5890	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:30.572480917 CET	192.168.2.14	8.8.8.8	0xbeda	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:31.214277029 CET	192.168.2.14	8.8.8.8	0x5352	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:31.852891922 CET	192.168.2.14	8.8.8.8	0x2d6d	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:32.519996881 CET	192.168.2.14	8.8.8.8	0x2efc	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:33.178396940 CET	192.168.2.14	8.8.8.8	0x9982	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:33.836755991 CET	192.168.2.14	8.8.8.8	0x5bbe	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:34.478250980 CET	192.168.2.14	8.8.8.8	0x2d8f	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:35.114765882 CET	192.168.2.14	8.8.8.8	0x30b0	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:35.763968945 CET	192.168.2.14	8.8.8.8	0x81c4	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:36.416230917 CET	192.168.2.14	8.8.8.8	0x1c0d	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:37.057840109 CET	192.168.2.14	8.8.8.8	0x5192	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:37.694319963 CET	192.168.2.14	8.8.8.8	0x4b9d	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:38.343728065 CET	192.168.2.14	8.8.8.8	0x531e	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:38.995170116 CET	192.168.2.14	8.8.8.8	0x414f	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:39.626385927 CET	192.168.2.14	8.8.8.8	0x5170	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:40.273195028 CET	192.168.2.14	8.8.8.8	0x1941	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:40.907769918 CET	192.168.2.14	8.8.8.8	0x2315	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:41.544929981 CET	192.168.2.14	8.8.8.8	0x4837	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:42.197418928 CET	192.168.2.14	8.8.8.8	0xff4d	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:42.841742992 CET	192.168.2.14	8.8.8.8	0xb199	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:43.498089075 CET	192.168.2.14	8.8.8.8	0xb6a7	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:44.132647038 CET	192.168.2.14	8.8.8.8	0xd133	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:44.771228075 CET	192.168.2.14	8.8.8.8	0x281f	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:45.410984039 CET	192.168.2.14	8.8.8.8	0x459a	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:46.054805040 CET	192.168.2.14	8.8.8.8	0x6137	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:46.712318897 CET	192.168.2.14	8.8.8.8	0xc729	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:47.360369921 CET	192.168.2.14	8.8.8.8	0x1ec8	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:48.002317905 CET	192.168.2.14	8.8.8.8	0xf8f8	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:48.661765099 CET	192.168.2.14	8.8.8.8	0x47e3	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:49.323101044 CET	192.168.2.14	8.8.8.8	0xddf8	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:49.961824894 CET	192.168.2.14	8.8.8.8	0x9647	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:50.602551937 CET	192.168.2.14	8.8.8.8	0x2e52	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:51.251276970 CET	192.168.2.14	8.8.8.8	0x35a8	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:51.883662939 CET	192.168.2.14	8.8.8.8	0x6dfe	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:52.548401117 CET	192.168.2.14	8.8.8.8	0x479e	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:53.180397987 CET	192.168.2.14	8.8.8.8	0xa3a3	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:53.821234941 CET	192.168.2.14	8.8.8.8	0x3221	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:54.464950085 CET	192.168.2.14	8.8.8.8	0x387d	Standard query (0)	srvy.vlrt-gap.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 30, 2024 03:44:17.032291889 CET	8.8.8.8	192.168.2.14	0x3562	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:17.711942911 CET	8.8.8.8	192.168.2.14	0x71cc	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:18.354156971 CET	8.8.8.8	192.168.2.14	0x7800	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:18.993520021 CET	8.8.8.8	192.168.2.14	0x8bc2	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:19.625124931 CET	8.8.8.8	192.168.2.14	0xe4b8	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:20.270910025 CET	8.8.8.8	192.168.2.14	0x3b9	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:20.906148911 CET	8.8.8.8	192.168.2.14	0x85c7	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:21.545228004 CET	8.8.8.8	192.168.2.14	0x2d60	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:22.181895018 CET	8.8.8.8	192.168.2.14	0x3226	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:22.821655989 CET	8.8.8.8	192.168.2.14	0x2ee4	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:23.476223946 CET	8.8.8.8	192.168.2.14	0x220c	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:24.124214888 CET	8.8.8.8	192.168.2.14	0xb9ac	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:24.755225897 CET	8.8.8.8	192.168.2.14	0x6928	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:25.389918089 CET	8.8.8.8	192.168.2.14	0xe8a3	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:26.026046038 CET	8.8.8.8	192.168.2.14	0xa111	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:26.676156998 CET	8.8.8.8	192.168.2.14	0x5b46	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:27.311152935 CET	8.8.8.8	192.168.2.14	0x4b8b	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:27.946471930 CET	8.8.8.8	192.168.2.14	0x9ae3	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:28.615058899 CET	8.8.8.8	192.168.2.14	0xc7a8	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:29.270075083 CET	8.8.8.8	192.168.2.14	0xf036	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:29.918132067 CET	8.8.8.8	192.168.2.14	0x5890	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:30.579032898 CET	8.8.8.8	192.168.2.14	0xbeda	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:31.221029043 CET	8.8.8.8	192.168.2.14	0x5352	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:31.860100985 CET	8.8.8.8	192.168.2.14	0x2d6d	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:32.526189089 CET	8.8.8.8	192.168.2.14	0x2efc	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:33.185724974 CET	8.8.8.8	192.168.2.14	0x9982	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:33.843513012 CET	8.8.8.8	192.168.2.14	0x5bbe	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:34.485212088 CET	8.8.8.8	192.168.2.14	0x2d8f	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:35.121846914 CET	8.8.8.8	192.168.2.14	0x30b0	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:35.770649910 CET	8.8.8.8	192.168.2.14	0x81c4	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:36.423521042 CET	8.8.8.8	192.168.2.14	0x1c0d	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:37.064402103 CET	8.8.8.8	192.168.2.14	0x5192	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:37.701452017 CET	8.8.8.8	192.168.2.14	0x4b9d	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:38.351108074 CET	8.8.8.8	192.168.2.14	0x531e	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:39.001427889 CET	8.8.8.8	192.168.2.14	0x414f	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:39.632736921 CET	8.8.8.8	192.168.2.14	0x5170	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:40.279686928 CET	8.8.8.8	192.168.2.14	0x1941	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:40.914836884 CET	8.8.8.8	192.168.2.14	0x2315	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:41.551594019 CET	8.8.8.8	192.168.2.14	0x4837	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:42.204499960 CET	8.8.8.8	192.168.2.14	0xff4d	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:42.848495960 CET	8.8.8.8	192.168.2.14	0xb199	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:43.504971981 CET	8.8.8.8	192.168.2.14	0xb6a7	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:44.139354944 CET	8.8.8.8	192.168.2.14	0xd133	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:44.777731895 CET	8.8.8.8	192.168.2.14	0x281f	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:45.417448997 CET	8.8.8.8	192.168.2.14	0x459a	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:46.060954094 CET	8.8.8.8	192.168.2.14	0x6137	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:46.718705893 CET	8.8.8.8	192.168.2.14	0xc729	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:47.367224932 CET	8.8.8.8	192.168.2.14	0x1ec8	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:48.008738041 CET	8.8.8.8	192.168.2.14	0xf8f8	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:48.668950081 CET	8.8.8.8	192.168.2.14	0x47e3	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:49.330452919 CET	8.8.8.8	192.168.2.14	0xddf8	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:49.968764067 CET	8.8.8.8	192.168.2.14	0x9647	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:50.609551907 CET	8.8.8.8	192.168.2.14	0x2e52	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:51.257719994 CET	8.8.8.8	192.168.2.14	0x35a8	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:51.890558004 CET	8.8.8.8	192.168.2.14	0x6dfe	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:52.554872036 CET	8.8.8.8	192.168.2.14	0x479e	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:53.188024044 CET	8.8.8.8	192.168.2.14	0xa3a3	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:53.828768015 CET	8.8.8.8	192.168.2.14	0x3221	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false
Dec 30, 2024 03:44:54.471847057 CET	8.8.8.8	192.168.2.14	0x387d	No error (0)	srvy.vlrt-gap.com	185.196.8.105	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: zmap.mips.elf PID: 5552, Parent PID: 5467

General

Start time (UTC):	02:44:16
Start date (UTC):	30/12/2024
Path:	/tmp/zmap.mips.elf
Arguments:	/tmp/zmap.mips.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: zmap.mips.elf PID: 5554, Parent PID: 5552

General

Start time (UTC):	02:44:16
Start date (UTC):	30/12/2024
Path:	/tmp/zmap.mips.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Chronological Activities

Analysis Process: zmap.mips.elf PID: 5556, Parent PID: 5554

General

Start time (UTC):	02:44:16
Start date (UTC):	30/12/2024
Path:	/tmp/zmap.mips.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report zmap.mips.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: zmap.mips.elf PID: 5552, Parent PID: 5467

General

Chronological Activities

Analysis Process: zmap.mips.elf PID: 5554, Parent PID: 5552

General

Chronological Activities

Analysis Process: zmap.mips.elf PID: 5556, Parent PID: 5554

General

Chronological Activities

Linux Analysis Report
zmap.mips.elf