Edit tour

Linux Analysis Report
fenty.arm5.elf

Overview

General Information

Sample name:	fenty.arm5.elf
Analysis ID:	1582422
MD5:	ec5f581daebaa326d03ba46e37cdd5c9
SHA1:	375e0c10b68918286ffed60f26f67d4e303ebb77
SHA256:	cad2cd08de68c447eb2bf94fb29da44bf71980b87fed7be07f538257232683b5
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample deletes itself

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582422
Start date and time:	2024-12-30 15:48:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	fenty.arm5.elf
Detection:	MAL
Classification:	mal72.troj.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/fenty.arm5.elf
PID:	6239
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Hello, World!
Standard Error:

Process Tree

system is lnxubuntu20

fenty.arm5.elf (PID: 6239, Parent: 6153, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/fenty.arm5.elf

fenty.arm5.elf New Fork (PID: 6241, Parent: 6239)

fenty.arm5.elf New Fork (PID: 6243, Parent: 6241)

fenty.arm5.elf New Fork (PID: 6245, Parent: 6241)

gnome-session-binary New Fork (PID: 6247, Parent: 1477)

sh (PID: 6247, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 6247, Parent: 1477, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
6239.1.00007f7bf4017000.00007f7bf4027000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6239.1.00007f7bf4017000.00007f7bf4027000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xe500:$x2: /dev/misc/watchdog 0xe4f0:$x3: /dev/watchdog 0xe53c:$x3: /dev/watchdog 0xe6b0:$s1: LCOGQGPTGP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: fenty.arm5.elf

ReversingLabs: Detection: 13%

Source: global traffic

TCP traffic: 192.168.2.23:50712 -> 185.196.9.234:2969

Source: /tmp/fenty.arm5.elf (PID: 6239)

Socket: 0.0.0.0:54721

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234

Source: fenty.arm5.elf

String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 6239.1.00007f7bf4017000.00007f7bf4027000.r-x.sdmp, type: MEMORY

Matched rule: Detects Mirai Botnet Malware Author: Florian Roth

Source: LOAD without section mappings

Program segment: 0x8000

Source: /tmp/fenty.arm5.elf (PID: 6245)	SIGKILL sent: pid: 788, result: successful	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6245)	SIGKILL sent: pid: 884, result: successful	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6245)	SIGKILL sent: pid: 1664, result: successful	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6245)	SIGKILL sent: pid: 2096, result: successful	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6245)	SIGKILL sent: pid: 2102, result: successful	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6245)	SIGKILL sent: pid: 6247, result: successful	Jump to behavior

Source: 6239.1.00007f7bf4017000.00007f7bf4027000.r-x.sdmp, type: MEMORY

Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b

Source: classification engine

Classification label: mal72.troj.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/6245/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/4509/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/4502/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/1494/cmdline	Jump to behavior
Source: /tmp/fenty.arm5.elf (PID: 6243)	File opened: /proc/260/cmdline	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/fenty.arm5.elf (PID: 6239)

File: /tmp/fenty.arm5.elf

Jump to behavior

Source: fenty.arm5.elf

Submission file: segment LOAD with 7.746 entropy (max. 8.0)

Source: /tmp/fenty.arm5.elf (PID: 6239)

Queries kernel information via 'uname':

Jump to behavior

Source: fenty.arm5.elf, 6239.1.00007ffd71e05000.00007ffd71e26000.rw-.sdmp	Binary or memory string: 6x86_64/usr/bin/qemu-arm/tmp/fenty.arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/fenty.arm5.elf
Source: fenty.arm5.elf, 6239.1.00005601afcca000.00005601afe18000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: fenty.arm5.elf, 6239.1.00007ffd71e05000.00007ffd71e26000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: fenty.arm5.elf, 6239.1.00005601afcca000.00005601afe18000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match

File source: 6239.1.00007f7bf4017000.00007f7bf4027000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match

File source: 6239.1.00007f7bf4017000.00007f7bf4027000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
fenty.arm5.elf	13%	ReversingLabs

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	fenty.arm5.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
185.196.9.234	unknown	Switzerland	42624	SIMPLECARRIERCH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	fs_elf_64.elf	Get hash	malicious	Unknown	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse
	tftp.elf	Get hash	malicious	Unknown	Browse
	i.elf	Get hash	malicious	Unknown	Browse
	xmrig.elf	Get hash	malicious	Xmrig	Browse
	vcimanagement.x86.elf	Get hash	malicious	Mirai	Browse
	vcimanagement.sh4.elf	Get hash	malicious	Mirai	Browse
	Aqua.m68k.elf	Get hash	malicious	Mirai	Browse
	botx.arm5.elf	Get hash	malicious	Mirai	Browse
	i.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	fs_elf_64.elf	Get hash	malicious	Unknown	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse
	tftp.elf	Get hash	malicious	Unknown	Browse
	i.elf	Get hash	malicious	Unknown	Browse
	xmrig.elf	Get hash	malicious	Xmrig	Browse
	vcimanagement.x86.elf	Get hash	malicious	Mirai	Browse
	vcimanagement.m68k.elf	Get hash	malicious	Mirai	Browse
	vcimanagement.sh4.elf	Get hash	malicious	Mirai	Browse
	Aqua.m68k.elf	Get hash	malicious	Mirai	Browse
	botx.arm5.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	fs_elf_64.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	tftp.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	xmrig.elf	Get hash	malicious	Xmrig	Browse	91.189.91.42
	vcimanagement.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	vcimanagement.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	vcimanagement.sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Aqua.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	botx.arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CANONICAL-ASGB	fs_elf_64.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	tftp.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	xmrig.elf	Get hash	malicious	Xmrig	Browse	91.189.91.42
	vcimanagement.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	vcimanagement.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	vcimanagement.sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Aqua.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	botx.arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
SIMPLECARRIERCH	sparc.elf	Get hash	malicious	Mirai	Browse	185.196.10.127
	armv6l.elf	Get hash	malicious	Mirai	Browse	185.196.10.127
	sh4.elf	Get hash	malicious	Mirai	Browse	185.196.10.127
	mips.elf	Get hash	malicious	Mirai	Browse	185.196.10.127
	mipsel.elf	Get hash	malicious	Mirai	Browse	185.196.10.127
	x86_64.elf	Get hash	malicious	Mirai	Browse	185.196.10.127
	armv7l.elf	Get hash	malicious	Mirai	Browse	185.196.10.127
	i686.elf	Get hash	malicious	Mirai	Browse	185.196.10.127
	i586.elf	Get hash	malicious	Mirai	Browse	185.196.10.127
	powerpc.elf	Get hash	malicious	Mirai	Browse	185.196.10.127
INIT7CH	fs_elf_64.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	arm5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	tftp.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	xmrig.elf	Get hash	malicious	Xmrig	Browse	109.202.202.202
	vcimanagement.x86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	vcimanagement.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	vcimanagement.sh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Aqua.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	botx.arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, no section header
Entropy (8bit):	7.742625011607436
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	fenty.arm5.elf
File size:	30'404 bytes
MD5:	ec5f581daebaa326d03ba46e37cdd5c9
SHA1:	375e0c10b68918286ffed60f26f67d4e303ebb77
SHA256:	cad2cd08de68c447eb2bf94fb29da44bf71980b87fed7be07f538257232683b5
SHA512:	36038ffa3cb00ef370536b2fcda4dc478ae32a2b0b10bfb452f44224558e688ef4d7e44ab33a4b8a48223fa337fd8ee8a2951570dff4528e2d3c48c2cece3e10
SSDEEP:	768:PyfoghLLLpyNQu66L2DTY72hWBIPbNQy+mCdla:PINdLLp8Qu66L2DK2MIBQzla
TLSH:	D7D2E10EA74E5301EE7D40F0005FE9FB9CA9C8AA34C4AB55DD962117759A5C1B33EEB0
File Content Preview:	.ELF...a..........(.........4...........4. ...(......................u...u..............h...h...h...................Q.td............................~..v1eg!X...................U.........ELF.ra....(........4..X.... ........g..g......._......Gh.n..%Y..Q..td

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0xec90
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8000	0x8000	0x75cb	0x75cb	7.7460	0x5	R E	0x8000
LOAD	0x1c68	0x21c68	0x21c68	0x0	0x0	0.0000	0x6	RW	0x8000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 15:48:51.010413885 CET	50712	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:51.016690969 CET	2969	50712	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:51.016783953 CET	50712	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:51.070544958 CET	50712	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:51.075444937 CET	2969	50712	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:51.075512886 CET	50712	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:51.080342054 CET	2969	50712	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:51.678843975 CET	2969	50712	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:51.678927898 CET	50712	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:51.679058075 CET	50712	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:51.679573059 CET	50714	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:51.684397936 CET	2969	50714	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:51.684458971 CET	50714	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:51.686750889 CET	50714	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:51.691540956 CET	2969	50714	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:51.691598892 CET	50714	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:51.696403027 CET	2969	50714	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:52.355602026 CET	2969	50714	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:52.355693102 CET	50714	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:52.355782032 CET	50714	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:52.356132984 CET	50716	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:52.361001968 CET	2969	50716	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:52.361084938 CET	50716	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:52.361893892 CET	50716	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:52.366695881 CET	2969	50716	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:52.366743088 CET	50716	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:52.371556044 CET	2969	50716	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:53.020612955 CET	2969	50716	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:53.024241924 CET	50716	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:53.024293900 CET	50716	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:53.024673939 CET	50718	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:53.029462099 CET	2969	50718	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:53.032146931 CET	50718	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:53.036689043 CET	50718	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:53.041501045 CET	2969	50718	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:53.044441938 CET	50718	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:53.049305916 CET	2969	50718	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:53.720477104 CET	2969	50718	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:53.720556021 CET	50718	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:53.720583916 CET	50718	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:53.720923901 CET	50720	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:53.725765944 CET	2969	50720	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:53.725852966 CET	50720	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:53.726457119 CET	50720	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:53.729432106 CET	43928	443	192.168.2.23	91.189.91.42
Dec 30, 2024 15:48:53.731254101 CET	2969	50720	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:53.731328964 CET	50720	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:53.736165047 CET	2969	50720	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:54.399122000 CET	2969	50720	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:54.399224043 CET	50720	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:54.399267912 CET	50720	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:54.399691105 CET	50722	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:54.404504061 CET	2969	50722	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:54.404567003 CET	50722	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:54.405441046 CET	50722	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:54.410242081 CET	2969	50722	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:54.410315990 CET	50722	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:54.415103912 CET	2969	50722	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:55.066978931 CET	2969	50722	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:55.067233086 CET	50722	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:55.067233086 CET	50722	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:55.067589045 CET	50724	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:55.072518110 CET	2969	50724	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:55.072575092 CET	50724	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:55.073271990 CET	50724	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:55.078083992 CET	2969	50724	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:55.078149080 CET	50724	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:55.083020926 CET	2969	50724	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:55.736625910 CET	2969	50724	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:55.736820936 CET	50724	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:55.736820936 CET	50724	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:55.737204075 CET	50726	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:55.742073059 CET	2969	50726	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:55.742132902 CET	50726	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:55.742744923 CET	50726	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:55.747594118 CET	2969	50726	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:55.747659922 CET	50726	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:55.752475023 CET	2969	50726	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:56.403346062 CET	2969	50726	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:56.403414011 CET	50726	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:56.403449059 CET	50726	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:56.403851986 CET	50728	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:56.408783913 CET	2969	50728	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:56.408850908 CET	50728	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:56.409661055 CET	50728	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:56.414510965 CET	2969	50728	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:56.414570093 CET	50728	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:56.419409990 CET	2969	50728	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:57.076558113 CET	2969	50728	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:57.076735020 CET	50728	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:57.076788902 CET	50728	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:57.077215910 CET	50730	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:57.082091093 CET	2969	50730	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:57.082171917 CET	50730	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:57.082721949 CET	50730	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:57.087565899 CET	2969	50730	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:57.087635994 CET	50730	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:57.092521906 CET	2969	50730	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:57.741089106 CET	2969	50730	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:57.741303921 CET	50730	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:57.741406918 CET	50730	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:57.741657019 CET	50732	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:57.746469021 CET	2969	50732	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:57.746515036 CET	50732	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:57.747339964 CET	50732	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:57.752080917 CET	2969	50732	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:57.752125978 CET	50732	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:57.756885052 CET	2969	50732	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:58.405528069 CET	2969	50732	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:58.405599117 CET	50732	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:58.405623913 CET	50732	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:58.405939102 CET	50734	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:58.410751104 CET	2969	50734	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:58.410803080 CET	50734	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:58.411386967 CET	50734	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:58.416119099 CET	2969	50734	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:58.416160107 CET	50734	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:58.420923948 CET	2969	50734	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:59.074064016 CET	2969	50734	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:59.074120998 CET	50734	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:59.074136019 CET	50734	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:59.074479103 CET	50736	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:59.079380035 CET	2969	50736	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:59.079427958 CET	50736	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:59.080286980 CET	50736	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:59.085067987 CET	2969	50736	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:59.085114956 CET	50736	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:59.089916945 CET	2969	50736	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:59.104661942 CET	42836	443	192.168.2.23	91.189.91.43
Dec 30, 2024 15:48:59.736227989 CET	2969	50736	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:59.736290932 CET	50736	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:59.736438990 CET	50736	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:59.736773968 CET	50738	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:59.741615057 CET	2969	50738	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:59.741693020 CET	50738	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:59.742398977 CET	50738	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:59.747270107 CET	2969	50738	185.196.9.234	192.168.2.23
Dec 30, 2024 15:48:59.747324944 CET	50738	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:48:59.752063990 CET	2969	50738	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:00.128555059 CET	42516	80	192.168.2.23	109.202.202.202
Dec 30, 2024 15:49:00.408233881 CET	2969	50738	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:00.408328056 CET	50738	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:00.408328056 CET	50738	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:00.408742905 CET	50740	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:00.413589001 CET	2969	50740	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:00.413651943 CET	50740	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:00.414256096 CET	50740	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:00.419089079 CET	2969	50740	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:00.419147015 CET	50740	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:00.423938036 CET	2969	50740	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:01.105568886 CET	2969	50740	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:01.105669022 CET	50740	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:01.105710030 CET	50740	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:01.106079102 CET	50742	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:01.111583948 CET	2969	50742	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:01.111660004 CET	50742	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:01.112293959 CET	50742	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:01.117677927 CET	2969	50742	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:01.117744923 CET	50742	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:01.123032093 CET	2969	50742	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:01.775480032 CET	2969	50742	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:01.775646925 CET	50742	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:01.775646925 CET	50742	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:01.776099920 CET	50744	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:01.780893087 CET	2969	50744	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:01.780977011 CET	50744	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:01.781609058 CET	50744	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:01.786406994 CET	2969	50744	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:01.786472082 CET	50744	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:01.791260004 CET	2969	50744	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:02.453399897 CET	2969	50744	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:02.453577042 CET	50744	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:02.453577042 CET	50744	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:02.454075098 CET	50746	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:02.458939075 CET	2969	50746	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:02.459044933 CET	50746	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:02.460000992 CET	50746	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:02.464802027 CET	2969	50746	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:02.464891911 CET	50746	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:02.469719887 CET	2969	50746	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:03.146310091 CET	2969	50746	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:03.146401882 CET	50746	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:03.146512985 CET	50746	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:03.146920919 CET	50748	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:03.151792049 CET	2969	50748	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:03.151860952 CET	50748	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:03.152621984 CET	50748	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:03.157411098 CET	2969	50748	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:03.157490969 CET	50748	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:03.162297964 CET	2969	50748	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:03.818377972 CET	2969	50748	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:03.818453074 CET	50748	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:03.818489075 CET	50748	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:03.819035053 CET	50750	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:03.823914051 CET	2969	50750	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:03.823973894 CET	50750	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:03.825093985 CET	50750	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:03.829922915 CET	2969	50750	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:03.829977036 CET	50750	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:03.834810972 CET	2969	50750	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:04.515536070 CET	2969	50750	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:04.515614033 CET	50750	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:04.515676022 CET	50750	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:04.516068935 CET	50752	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:04.520904064 CET	2969	50752	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:04.520982981 CET	50752	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:04.521893024 CET	50752	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:04.526726961 CET	2969	50752	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:04.526778936 CET	50752	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:04.531631947 CET	2969	50752	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:05.181607008 CET	2969	50752	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:05.181708097 CET	50752	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:05.181749105 CET	50752	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:05.182306051 CET	50754	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:05.188422918 CET	2969	50754	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:05.188519955 CET	50754	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:05.189506054 CET	50754	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:05.195390940 CET	2969	50754	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:05.195450068 CET	50754	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:05.200315952 CET	2969	50754	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:05.852309942 CET	2969	50754	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:05.852375031 CET	50754	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:05.852402925 CET	50754	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:05.852737904 CET	50756	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:05.857635021 CET	2969	50756	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:05.857697964 CET	50756	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:05.858335972 CET	50756	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:05.863140106 CET	2969	50756	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:05.863187075 CET	50756	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:05.868062019 CET	2969	50756	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:07.402101994 CET	2969	50756	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:07.402194977 CET	2969	50756	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:07.402213097 CET	50756	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:07.402213097 CET	50756	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:07.402245045 CET	50756	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:07.402275085 CET	2969	50756	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:07.402319908 CET	50756	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:07.402554989 CET	50758	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:07.406641960 CET	2969	50756	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:07.406693935 CET	50756	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:07.407381058 CET	2969	50758	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:07.407434940 CET	50758	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:07.407984972 CET	50758	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:07.412822008 CET	2969	50758	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:07.412869930 CET	50758	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:07.417642117 CET	2969	50758	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:08.064254999 CET	2969	50758	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:08.064331055 CET	50758	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:08.064353943 CET	50758	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:08.064656019 CET	50760	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:08.069571972 CET	2969	50760	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:08.069726944 CET	50760	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:08.070296049 CET	50760	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:08.075133085 CET	2969	50760	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:08.075186968 CET	50760	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:08.079981089 CET	2969	50760	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:08.747749090 CET	2969	50760	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:08.747858047 CET	50760	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:08.747944117 CET	50760	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:08.748390913 CET	50762	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:08.753168106 CET	2969	50762	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:08.753217936 CET	50762	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:08.754319906 CET	50762	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:08.759156942 CET	2969	50762	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:08.759224892 CET	50762	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:08.764027119 CET	2969	50762	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:09.432683945 CET	2969	50762	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:09.432777882 CET	50762	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:09.432820082 CET	50762	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:09.433155060 CET	50764	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:09.438114882 CET	2969	50764	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:09.438186884 CET	50764	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:09.438730955 CET	50764	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:09.443574905 CET	2969	50764	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:09.443644047 CET	50764	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:09.448497057 CET	2969	50764	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:10.100574970 CET	2969	50764	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:10.100663900 CET	50764	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:10.100711107 CET	50764	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:10.101005077 CET	50766	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:10.105818987 CET	2969	50766	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:10.105882883 CET	50766	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:10.106360912 CET	50766	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:10.111224890 CET	2969	50766	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:10.111280918 CET	50766	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:10.116162062 CET	2969	50766	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:10.789812088 CET	2969	50766	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:10.790013075 CET	50766	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:10.790060997 CET	50766	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:10.790365934 CET	50768	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:10.795203924 CET	2969	50768	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:10.795273066 CET	50768	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:10.795824051 CET	50768	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:10.800605059 CET	2969	50768	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:10.800672054 CET	50768	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:10.805485964 CET	2969	50768	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:11.458437920 CET	2969	50768	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:11.458590031 CET	50768	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:11.458735943 CET	50768	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:11.459146023 CET	50770	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:11.463969946 CET	2969	50770	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:11.464034081 CET	50770	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:11.464636087 CET	50770	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:11.469468117 CET	2969	50770	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:11.469552994 CET	50770	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:11.474440098 CET	2969	50770	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:12.840205908 CET	2969	50770	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:12.840284109 CET	50770	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:12.840331078 CET	50770	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:12.840423107 CET	2969	50770	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:12.840476990 CET	50770	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:12.840498924 CET	2969	50770	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:12.840545893 CET	50770	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:12.840614080 CET	2969	50770	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:12.840657949 CET	50770	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:12.840701103 CET	50772	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:13.033766985 CET	2969	50770	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:13.034008980 CET	50770	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:13.034941912 CET	2969	50772	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:13.035020113 CET	50772	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:13.035840034 CET	50772	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:13.040608883 CET	2969	50772	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:13.040664911 CET	50772	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:13.045409918 CET	2969	50772	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:13.697792053 CET	2969	50772	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:13.697855949 CET	50772	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:13.697901011 CET	50772	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:13.698199987 CET	50774	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:13.703043938 CET	2969	50774	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:13.703104019 CET	50774	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:13.703711987 CET	50774	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:13.708511114 CET	2969	50774	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:13.708551884 CET	50774	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:13.713319063 CET	2969	50774	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:14.369339943 CET	2969	50774	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:14.369411945 CET	50774	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:14.369436026 CET	50774	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:14.369940042 CET	50776	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:14.374818087 CET	2969	50776	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:14.374871016 CET	50776	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:14.375468016 CET	50776	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:14.380235910 CET	2969	50776	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:14.380286932 CET	50776	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:14.385705948 CET	2969	50776	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:14.718672991 CET	43928	443	192.168.2.23	91.189.91.42
Dec 30, 2024 15:49:15.037918091 CET	2969	50776	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:15.038187027 CET	50776	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:15.038307905 CET	50776	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:15.038790941 CET	50778	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:15.044370890 CET	2969	50778	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:15.044430971 CET	50778	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:15.045245886 CET	50778	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:15.050071001 CET	2969	50778	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:15.050111055 CET	50778	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:15.054924011 CET	2969	50778	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:15.720487118 CET	2969	50778	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:15.720571041 CET	50778	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:15.720769882 CET	50778	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:15.721101046 CET	50780	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:15.725958109 CET	2969	50780	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:15.726020098 CET	50780	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:15.726819038 CET	50780	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:15.731615067 CET	2969	50780	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:15.731673956 CET	50780	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:15.736490011 CET	2969	50780	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:16.416666031 CET	2969	50780	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:16.416723967 CET	50780	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:16.416878939 CET	50780	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:16.417133093 CET	50782	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:16.422012091 CET	2969	50782	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:16.422065973 CET	50782	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:16.422864914 CET	50782	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:16.427637100 CET	2969	50782	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:16.427689075 CET	50782	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:16.432490110 CET	2969	50782	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:17.095820904 CET	2969	50782	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:17.095892906 CET	50782	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:17.096039057 CET	50782	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:17.096410990 CET	50784	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:17.101536036 CET	2969	50784	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:17.101598024 CET	50784	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:17.102211952 CET	50784	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:17.106981993 CET	2969	50784	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:17.107037067 CET	50784	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:17.111824036 CET	2969	50784	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:17.772888899 CET	2969	50784	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:17.773020983 CET	50784	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:17.773174047 CET	50784	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:17.773575068 CET	50786	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:17.778434038 CET	2969	50786	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:17.778515100 CET	50786	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:17.779380083 CET	50786	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:17.784195900 CET	2969	50786	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:17.784261942 CET	50786	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:17.789100885 CET	2969	50786	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:18.440985918 CET	2969	50786	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:18.441087008 CET	50786	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:18.441267967 CET	50786	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:18.441642046 CET	50788	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:18.446512938 CET	2969	50788	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:18.446593046 CET	50788	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:18.447463989 CET	50788	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:18.452447891 CET	2969	50788	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:18.452522993 CET	50788	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:18.457370996 CET	2969	50788	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:19.118771076 CET	2969	50788	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:19.118880987 CET	50788	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:19.118962049 CET	50788	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:19.119529009 CET	50790	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:19.124362946 CET	2969	50790	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:19.124466896 CET	50790	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:19.125361919 CET	50790	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:19.130197048 CET	2969	50790	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:19.130316019 CET	50790	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:19.135109901 CET	2969	50790	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:19.792697906 CET	2969	50790	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:19.792922974 CET	50790	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:19.793128014 CET	50790	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:19.793644905 CET	50792	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:19.798532963 CET	2969	50792	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:19.798618078 CET	50792	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:19.799482107 CET	50792	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:19.804343939 CET	2969	50792	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:19.804411888 CET	50792	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:19.809232950 CET	2969	50792	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:20.454477072 CET	2969	50792	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:20.454756021 CET	50792	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:20.454816103 CET	50792	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:20.455385923 CET	50794	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:20.460273027 CET	2969	50794	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:20.460377932 CET	50794	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:20.461241007 CET	50794	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:20.466113091 CET	2969	50794	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:20.466181040 CET	50794	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:20.471029997 CET	2969	50794	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:21.134934902 CET	2969	50794	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:21.135272980 CET	50794	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:21.135272980 CET	50794	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:21.135731936 CET	50796	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:21.140614033 CET	2969	50796	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:21.140707016 CET	50796	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:21.141469955 CET	50796	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:21.146279097 CET	2969	50796	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:21.146341085 CET	50796	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:21.151139975 CET	2969	50796	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:21.812923908 CET	2969	50796	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:21.813148022 CET	50796	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:21.813225985 CET	50796	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:21.813685894 CET	50798	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:21.818506956 CET	2969	50798	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:21.818582058 CET	50798	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:21.819355965 CET	50798	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:21.824177027 CET	2969	50798	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:21.824249029 CET	50798	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:21.829041004 CET	2969	50798	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:22.485627890 CET	2969	50798	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:22.485866070 CET	50798	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:22.485930920 CET	50798	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:22.486422062 CET	50800	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:22.491301060 CET	2969	50800	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:22.491364002 CET	50800	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:22.492172956 CET	50800	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:22.496965885 CET	2969	50800	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:22.497020960 CET	50800	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:22.504162073 CET	2969	50800	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:23.206258059 CET	2969	50800	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:23.206336021 CET	50800	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:23.206453085 CET	50800	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:23.206938982 CET	50802	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:23.211786032 CET	2969	50802	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:23.211842060 CET	50802	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:23.212620974 CET	50802	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:23.217421055 CET	2969	50802	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:23.217480898 CET	50802	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:23.222305059 CET	2969	50802	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:23.870600939 CET	2969	50802	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:23.870657921 CET	50802	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:23.870757103 CET	50802	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:23.871186018 CET	50804	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:23.876049995 CET	2969	50804	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:23.876108885 CET	50804	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:23.876868010 CET	50804	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:23.882018089 CET	2969	50804	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:23.882070065 CET	50804	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:23.887645960 CET	2969	50804	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:24.535629988 CET	2969	50804	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:24.535702944 CET	50804	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:24.535770893 CET	50804	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:24.536232948 CET	50806	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:24.541145086 CET	2969	50806	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:24.541213036 CET	50806	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:24.542064905 CET	50806	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:24.546864033 CET	2969	50806	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:24.546920061 CET	50806	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:24.551767111 CET	2969	50806	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:24.957154036 CET	42836	443	192.168.2.23	91.189.91.43
Dec 30, 2024 15:49:25.205934048 CET	2969	50806	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:25.206089973 CET	50806	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:25.206237078 CET	50806	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:25.206564903 CET	50808	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:25.211379051 CET	2969	50808	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:25.211433887 CET	50808	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:25.212304115 CET	50808	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:25.217113018 CET	2969	50808	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:25.217163086 CET	50808	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:25.222002029 CET	2969	50808	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:25.876774073 CET	2969	50808	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:25.876852989 CET	50808	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:25.876909971 CET	50808	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:25.877397060 CET	50810	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:25.882219076 CET	2969	50810	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:25.882283926 CET	50810	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:25.882857084 CET	50810	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:25.887633085 CET	2969	50810	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:25.887686968 CET	50810	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:25.892520905 CET	2969	50810	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:26.542213917 CET	2969	50810	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:26.542366028 CET	50810	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:26.542638063 CET	50810	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:26.543200970 CET	50812	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:26.548090935 CET	2969	50812	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:26.548180103 CET	50812	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:26.549081087 CET	50812	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:26.553922892 CET	2969	50812	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:26.554008007 CET	50812	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:26.558860064 CET	2969	50812	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:27.210999012 CET	2969	50812	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:27.211148024 CET	50812	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:27.211302996 CET	50812	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:27.211956024 CET	50814	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:27.216885090 CET	2969	50814	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:27.216952085 CET	50814	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:27.217752934 CET	50814	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:27.222572088 CET	2969	50814	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:27.222646952 CET	50814	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:27.227519035 CET	2969	50814	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:27.951401949 CET	2969	50814	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:27.951560020 CET	50814	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:27.951833010 CET	50814	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:27.952168941 CET	50816	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:27.957201004 CET	2969	50816	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:27.957258940 CET	50816	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:27.958058119 CET	50816	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:27.962840080 CET	2969	50816	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:27.962893009 CET	50816	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:27.967724085 CET	2969	50816	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:28.663567066 CET	2969	50816	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:28.663635015 CET	50816	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:28.663881063 CET	50816	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:28.664376020 CET	50818	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:28.669193029 CET	2969	50818	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:28.669258118 CET	50818	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:28.670063972 CET	50818	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:28.675091982 CET	2969	50818	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:28.675143957 CET	50818	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:28.679982901 CET	2969	50818	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:29.325444937 CET	2969	50818	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:29.325504065 CET	50818	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:29.325557947 CET	50818	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:29.325874090 CET	50820	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:29.330739021 CET	2969	50820	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:29.330801964 CET	50820	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:29.331362009 CET	50820	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:29.336186886 CET	2969	50820	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:29.336237907 CET	50820	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:29.341068029 CET	2969	50820	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:30.012398005 CET	2969	50820	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:30.012670994 CET	50820	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:30.012778044 CET	50820	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:30.013267040 CET	50822	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:30.018131018 CET	2969	50822	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:30.018213987 CET	50822	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:30.018996954 CET	50822	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:30.023799896 CET	2969	50822	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:30.023858070 CET	50822	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:30.028734922 CET	2969	50822	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:30.680589914 CET	2969	50822	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:30.680665016 CET	50822	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:30.680839062 CET	50822	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:30.681318045 CET	50824	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:30.686430931 CET	2969	50824	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:30.686496973 CET	50824	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:30.687268972 CET	50824	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:30.692773104 CET	2969	50824	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:30.692823887 CET	50824	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:30.697792053 CET	2969	50824	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:31.100253105 CET	42516	80	192.168.2.23	109.202.202.202
Dec 30, 2024 15:49:31.346503019 CET	2969	50824	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:31.346580029 CET	50824	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:31.346632004 CET	50824	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:31.346967936 CET	50826	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:31.351777077 CET	2969	50826	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:31.351830959 CET	50826	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:31.352438927 CET	50826	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:31.357275009 CET	2969	50826	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:31.357326984 CET	50826	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:31.362159967 CET	2969	50826	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:32.030621052 CET	2969	50826	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:32.030771971 CET	50826	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:32.030771971 CET	50826	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:32.031042099 CET	50828	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:32.035949945 CET	2969	50828	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:32.036010027 CET	50828	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:32.036607981 CET	50828	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:32.041419983 CET	2969	50828	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:32.041474104 CET	50828	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:32.046282053 CET	2969	50828	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:32.695494890 CET	2969	50828	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:32.695684910 CET	50828	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:32.695837975 CET	50828	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:32.696275949 CET	50830	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:32.701118946 CET	2969	50830	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:32.701175928 CET	50830	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:32.701775074 CET	50830	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:32.706566095 CET	2969	50830	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:32.706620932 CET	50830	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:32.711435080 CET	2969	50830	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:33.391870975 CET	2969	50830	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:33.391973019 CET	50830	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:33.392014980 CET	50830	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:33.392323017 CET	50832	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:33.397214890 CET	2969	50832	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:33.397281885 CET	50832	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:33.397886038 CET	50832	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:33.402736902 CET	2969	50832	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:33.402801037 CET	50832	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:33.407602072 CET	2969	50832	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:34.080463886 CET	2969	50832	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:34.080547094 CET	50832	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:34.080595016 CET	50832	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:34.080935001 CET	50834	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:34.085732937 CET	2969	50834	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:34.085781097 CET	50834	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:34.086342096 CET	50834	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:34.091124058 CET	2969	50834	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:34.091170073 CET	50834	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:34.095928907 CET	2969	50834	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:34.740989923 CET	2969	50834	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:34.741072893 CET	50834	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:34.741122007 CET	50834	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:34.741415024 CET	50836	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:34.746216059 CET	2969	50836	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:34.746295929 CET	50836	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:34.747023106 CET	50836	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:34.751878023 CET	2969	50836	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:34.751935005 CET	50836	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:34.756778002 CET	2969	50836	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:35.414136887 CET	2969	50836	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:35.414213896 CET	50836	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:35.414372921 CET	50836	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:35.414664984 CET	50838	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:35.419497013 CET	2969	50838	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:35.419550896 CET	50838	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:35.420135021 CET	50838	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:35.424968958 CET	2969	50838	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:35.425019979 CET	50838	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:35.429914951 CET	2969	50838	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:36.099134922 CET	2969	50838	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:36.099293947 CET	50838	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:36.099293947 CET	50838	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:36.099591970 CET	50840	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:36.104448080 CET	2969	50840	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:36.104502916 CET	50840	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:36.105074883 CET	50840	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:36.109844923 CET	2969	50840	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:36.109888077 CET	50840	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:36.114795923 CET	2969	50840	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:36.790920019 CET	2969	50840	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:36.790994883 CET	50840	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:36.791028023 CET	50840	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:36.791531086 CET	50842	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:36.796395063 CET	2969	50842	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:36.796446085 CET	50842	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:36.797521114 CET	50842	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:36.802334070 CET	2969	50842	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:36.802383900 CET	50842	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:36.807260036 CET	2969	50842	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:37.455913067 CET	2969	50842	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:37.456017017 CET	50842	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:37.456058979 CET	50842	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:37.456499100 CET	50844	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:37.461376905 CET	2969	50844	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:37.461436987 CET	50844	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:37.462076902 CET	50844	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:37.466887951 CET	2969	50844	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:37.466953993 CET	50844	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:37.471741915 CET	2969	50844	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:38.131947041 CET	2969	50844	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:38.132126093 CET	50844	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:38.132245064 CET	50844	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:38.132698059 CET	50846	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:38.137475014 CET	2969	50846	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:38.137533903 CET	50846	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:38.138163090 CET	50846	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:38.142988920 CET	2969	50846	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:38.143049002 CET	50846	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:38.147830963 CET	2969	50846	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:38.821484089 CET	2969	50846	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:38.821588993 CET	50846	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:38.821738005 CET	50846	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:38.822221994 CET	50848	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:38.827089071 CET	2969	50848	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:38.827152967 CET	50848	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:38.827987909 CET	50848	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:38.832803011 CET	2969	50848	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:38.832854986 CET	50848	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:38.837672949 CET	2969	50848	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:39.495522976 CET	2969	50848	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:39.495757103 CET	50848	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:39.495795012 CET	50848	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:39.496155977 CET	50850	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:39.500966072 CET	2969	50850	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:39.501029015 CET	50850	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:39.501653910 CET	50850	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:39.506454945 CET	2969	50850	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:39.506506920 CET	50850	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:39.511375904 CET	2969	50850	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:40.161303997 CET	2969	50850	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:40.161360979 CET	50850	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:40.161453962 CET	50850	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:40.161870956 CET	50852	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:40.166779995 CET	2969	50852	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:40.166838884 CET	50852	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:40.167656898 CET	50852	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:40.172569036 CET	2969	50852	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:40.172622919 CET	50852	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:40.177417994 CET	2969	50852	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:40.833725929 CET	2969	50852	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:40.833784103 CET	50852	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:40.833900928 CET	50852	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:40.834456921 CET	50854	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:40.839360952 CET	2969	50854	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:40.839432001 CET	50854	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:40.840231895 CET	50854	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:40.845032930 CET	2969	50854	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:40.845086098 CET	50854	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:40.849936962 CET	2969	50854	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:41.499439955 CET	2969	50854	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:41.499514103 CET	50854	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:41.499598026 CET	50854	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:41.500108957 CET	50856	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:41.504987955 CET	2969	50856	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:41.505045891 CET	50856	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:41.505839109 CET	50856	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:41.510632038 CET	2969	50856	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:41.510674000 CET	50856	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:41.515544891 CET	2969	50856	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:42.189264059 CET	2969	50856	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:42.189328909 CET	50856	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:42.189528942 CET	50856	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:42.189901114 CET	50858	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:42.194679022 CET	2969	50858	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:42.194741011 CET	50858	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:42.195543051 CET	50858	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:42.200305939 CET	2969	50858	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:42.200366020 CET	50858	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:42.205849886 CET	2969	50858	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:42.857620955 CET	2969	50858	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:42.857687950 CET	50858	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:42.857929945 CET	50858	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:42.858450890 CET	50860	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:42.863293886 CET	2969	50860	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:42.863348961 CET	50860	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:42.864145041 CET	50860	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:42.868968964 CET	2969	50860	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:42.869020939 CET	50860	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:42.873851061 CET	2969	50860	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:43.519785881 CET	2969	50860	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:43.519836903 CET	50860	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:43.519996881 CET	50860	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:43.520432949 CET	50862	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:43.525250912 CET	2969	50862	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:43.525305033 CET	50862	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:43.526115894 CET	50862	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:43.530936956 CET	2969	50862	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:43.531001091 CET	50862	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:43.535797119 CET	2969	50862	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:44.206585884 CET	2969	50862	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:44.206654072 CET	50862	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:44.206903934 CET	50862	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:44.207421064 CET	50864	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:44.212272882 CET	2969	50864	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:44.212368965 CET	50864	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:44.213474035 CET	50864	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:44.218317032 CET	2969	50864	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:44.218386889 CET	50864	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:44.223229885 CET	2969	50864	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:44.871572971 CET	2969	50864	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:44.871680021 CET	50864	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:44.871807098 CET	50864	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:44.872319937 CET	50866	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:44.877114058 CET	2969	50866	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:44.877196074 CET	50866	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:44.877994061 CET	50866	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:44.882852077 CET	2969	50866	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:44.882917881 CET	50866	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:44.887763977 CET	2969	50866	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:45.568470955 CET	2969	50866	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:45.568685055 CET	50866	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:45.568775892 CET	50866	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:45.569304943 CET	50868	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:45.574207067 CET	2969	50868	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:45.574296951 CET	50868	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:45.575093031 CET	50868	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:45.579905987 CET	2969	50868	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:45.579977989 CET	50868	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:45.584796906 CET	2969	50868	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:46.229569912 CET	2969	50868	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:46.229680061 CET	50868	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:46.229823112 CET	50868	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:46.230218887 CET	50870	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:46.235038042 CET	2969	50870	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:46.235131025 CET	50870	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:46.235883951 CET	50870	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:46.240677118 CET	2969	50870	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:46.240770102 CET	50870	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:46.245563984 CET	2969	50870	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:46.897921085 CET	2969	50870	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:46.898042917 CET	50870	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:46.898169994 CET	50870	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:46.898662090 CET	50872	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:46.903554916 CET	2969	50872	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:46.903637886 CET	50872	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:46.904335022 CET	50872	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:46.909182072 CET	2969	50872	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:46.909239054 CET	50872	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:46.914072037 CET	2969	50872	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:47.577416897 CET	2969	50872	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:47.577600956 CET	50872	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:47.577769995 CET	50872	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:47.578087091 CET	50874	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:47.582922935 CET	2969	50874	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:47.582995892 CET	50874	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:47.583646059 CET	50874	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:47.588516951 CET	2969	50874	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:47.588584900 CET	50874	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:47.593414068 CET	2969	50874	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:48.251441002 CET	2969	50874	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:48.251673937 CET	50874	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:48.251673937 CET	50874	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:48.251996994 CET	50876	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:48.256864071 CET	2969	50876	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:48.256948948 CET	50876	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:48.257695913 CET	50876	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:48.262485981 CET	2969	50876	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:48.262553930 CET	50876	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:48.267396927 CET	2969	50876	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:48.915683985 CET	2969	50876	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:48.915752888 CET	50876	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:48.915786982 CET	50876	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:48.916098118 CET	50878	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:48.920945883 CET	2969	50878	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:48.920995951 CET	50878	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:48.921570063 CET	50878	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:48.926413059 CET	2969	50878	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:48.926464081 CET	50878	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:48.931344986 CET	2969	50878	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:49.602077961 CET	2969	50878	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:49.602159023 CET	50878	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:49.602210999 CET	50878	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:49.602509975 CET	50880	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:49.607296944 CET	2969	50880	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:49.607358932 CET	50880	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:49.607980013 CET	50880	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:49.612767935 CET	2969	50880	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:49.612813950 CET	50880	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:49.617752075 CET	2969	50880	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:50.290067911 CET	2969	50880	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:50.290138960 CET	50880	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:50.290231943 CET	50880	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:50.290683031 CET	50882	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:50.295535088 CET	2969	50882	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:50.295589924 CET	50882	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:50.296386957 CET	50882	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:50.301199913 CET	2969	50882	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:50.301263094 CET	50882	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:50.306086063 CET	2969	50882	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:50.957881927 CET	2969	50882	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:50.957961082 CET	50882	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:50.958039999 CET	50882	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:50.958494902 CET	50884	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:50.963490009 CET	2969	50884	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:50.963548899 CET	50884	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:50.964412928 CET	50884	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:50.969229937 CET	2969	50884	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:50.969294071 CET	50884	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:50.974123001 CET	2969	50884	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:51.647135973 CET	2969	50884	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:51.647217989 CET	50884	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:51.647331953 CET	50884	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:51.647797108 CET	50886	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:51.652710915 CET	2969	50886	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:51.652767897 CET	50886	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:51.653629065 CET	50886	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:51.658433914 CET	2969	50886	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:51.658503056 CET	50886	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:51.663356066 CET	2969	50886	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:52.320518970 CET	2969	50886	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:52.320626020 CET	50886	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:52.320674896 CET	50886	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:52.321172953 CET	50888	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:52.326030016 CET	2969	50888	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:52.326092958 CET	50888	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:52.326946974 CET	50888	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:52.331760883 CET	2969	50888	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:52.331837893 CET	50888	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:52.336683989 CET	2969	50888	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:52.988403082 CET	2969	50888	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:52.988459110 CET	50888	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:52.988595009 CET	50888	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:52.988905907 CET	50890	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:52.993765116 CET	2969	50890	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:52.993829966 CET	50890	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:52.994450092 CET	50890	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:52.999262094 CET	2969	50890	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:52.999327898 CET	50890	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:53.004482031 CET	2969	50890	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:53.685539961 CET	2969	50890	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:53.685710907 CET	50890	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:53.685928106 CET	50890	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:53.686477900 CET	50892	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:53.691334963 CET	2969	50892	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:53.691386938 CET	50892	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:53.692240953 CET	50892	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:53.697072983 CET	2969	50892	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:53.697134018 CET	50892	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:53.702001095 CET	2969	50892	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:54.375117064 CET	2969	50892	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:54.375195026 CET	50892	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:54.375256062 CET	50892	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:54.375704050 CET	50894	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:54.380599976 CET	2969	50894	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:54.380660057 CET	50894	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:54.381467104 CET	50894	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:54.386307001 CET	2969	50894	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:54.386368036 CET	50894	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:54.392117977 CET	2969	50894	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:55.062362909 CET	2969	50894	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:55.062469006 CET	50894	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:55.062521935 CET	50894	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:55.062988043 CET	50896	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:55.068432093 CET	2969	50896	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:55.068527937 CET	50896	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:55.069361925 CET	50896	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:55.074959040 CET	2969	50896	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:55.075026035 CET	50896	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:55.079802036 CET	2969	50896	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:55.672914982 CET	43928	443	192.168.2.23	91.189.91.42
Dec 30, 2024 15:49:55.725693941 CET	2969	50896	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:55.725853920 CET	50896	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:55.725938082 CET	50896	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:55.726371050 CET	50898	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:55.731328011 CET	2969	50898	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:55.731425047 CET	50898	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:55.732295990 CET	50898	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:55.737152100 CET	2969	50898	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:55.737281084 CET	50898	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:55.742166042 CET	2969	50898	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:56.410126925 CET	2969	50898	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:56.410315990 CET	50898	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:56.410414934 CET	50898	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:56.410914898 CET	50900	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:56.415746927 CET	2969	50900	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:56.415829897 CET	50900	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:56.416760921 CET	50900	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:56.421567917 CET	2969	50900	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:56.421696901 CET	50900	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:56.426496029 CET	2969	50900	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:57.099760056 CET	2969	50900	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:57.099925995 CET	50900	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:57.100029945 CET	50900	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:57.100492001 CET	50902	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:57.105310917 CET	2969	50902	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:57.105398893 CET	50902	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:57.106210947 CET	50902	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:57.111002922 CET	2969	50902	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:57.111134052 CET	50902	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:57.115952969 CET	2969	50902	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:57.778835058 CET	2969	50902	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:57.778934002 CET	50902	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:57.778985977 CET	50902	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:57.779407978 CET	50904	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:57.785290003 CET	2969	50904	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:57.785351038 CET	50904	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:57.785954952 CET	50904	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:57.790795088 CET	2969	50904	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:57.790858030 CET	50904	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:57.795757055 CET	2969	50904	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:58.447236061 CET	2969	50904	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:58.447329998 CET	50904	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:58.447355986 CET	50904	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:58.447647095 CET	50906	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:58.452532053 CET	2969	50906	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:58.452616930 CET	50906	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:58.453373909 CET	50906	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:58.458214045 CET	2969	50906	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:58.458281040 CET	50906	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:58.463088989 CET	2969	50906	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:59.118046999 CET	2969	50906	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:59.118134975 CET	50906	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:59.118181944 CET	50906	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:59.118486881 CET	50908	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:59.123379946 CET	2969	50908	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:59.123435974 CET	50908	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:59.124042988 CET	50908	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:59.128854036 CET	2969	50908	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:59.128950119 CET	50908	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:59.133775949 CET	2969	50908	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:59.779233932 CET	2969	50908	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:59.779337883 CET	50908	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:59.779422998 CET	50908	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:59.779841900 CET	50910	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:59.784699917 CET	2969	50910	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:59.784826994 CET	50910	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:59.785590887 CET	50910	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:59.790402889 CET	2969	50910	185.196.9.234	192.168.2.23
Dec 30, 2024 15:49:59.790469885 CET	50910	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:49:59.795270920 CET	2969	50910	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:00.456887007 CET	2969	50910	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:00.457001925 CET	50910	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:00.457076073 CET	50910	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:00.457519054 CET	50912	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:00.462455034 CET	2969	50912	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:00.462512970 CET	50912	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:00.463095903 CET	50912	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:00.467889071 CET	2969	50912	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:00.467941046 CET	50912	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:00.472791910 CET	2969	50912	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:01.125391960 CET	2969	50912	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:01.125457048 CET	50912	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:01.125509024 CET	50912	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:01.125777960 CET	50914	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:01.130640984 CET	2969	50914	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:01.130707979 CET	50914	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:01.131302118 CET	50914	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:01.136136055 CET	2969	50914	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:01.136214018 CET	50914	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:01.141031981 CET	2969	50914	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:01.980062008 CET	2969	50914	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:01.980154991 CET	50914	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:01.980242014 CET	50914	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:01.980676889 CET	50916	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:01.980691910 CET	2969	50914	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:01.980724096 CET	2969	50914	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:01.980756044 CET	50914	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:01.980781078 CET	50914	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:01.985515118 CET	2969	50916	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:01.985569000 CET	50916	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:01.986377001 CET	50916	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:01.991177082 CET	2969	50916	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:01.991241932 CET	50916	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:01.996026993 CET	2969	50916	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:02.641504049 CET	2969	50916	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:02.641608953 CET	50916	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:02.641676903 CET	50916	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:02.642155886 CET	50918	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:02.646936893 CET	2969	50918	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:02.646991968 CET	50918	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:02.647917986 CET	50918	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:02.652666092 CET	2969	50918	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:02.652745008 CET	50918	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:02.657545090 CET	2969	50918	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:03.311522007 CET	2969	50918	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:03.311583042 CET	50918	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:03.311651945 CET	50918	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:03.312150002 CET	50920	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:03.317101002 CET	2969	50920	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:03.317157984 CET	50920	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:03.318001032 CET	50920	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:03.322824001 CET	2969	50920	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:03.322875977 CET	50920	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:03.327708006 CET	2969	50920	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:13.326960087 CET	50920	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:13.332066059 CET	2969	50920	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:13.534197092 CET	2969	50920	185.196.9.234	192.168.2.23
Dec 30, 2024 15:50:13.534254074 CET	50920	2969	192.168.2.23	185.196.9.234
Dec 30, 2024 15:50:16.150089025 CET	42836	443	192.168.2.23	91.189.91.43

System Behavior

Analysis Process: fenty.arm5.elf PID: 6239, Parent PID: 6153

General

Start time (UTC):	14:48:49
Start date (UTC):	30/12/2024
Path:	/tmp/fenty.arm5.elf
Arguments:	/tmp/fenty.arm5.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	14:48:49
Start date (UTC):	30/12/2024
Path:	/tmp/fenty.arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	14:48:49
Start date (UTC):	30/12/2024
Path:	/tmp/fenty.arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	14:48:49
Start date (UTC):	30/12/2024
Path:	/tmp/fenty.arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	14:48:50
Start date (UTC):	30/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	14:48:50
Start date (UTC):	30/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	14:48:50
Start date (UTC):	30/12/2024
Path:	/usr/libexec/gsd-housekeeping
Arguments:	/usr/libexec/gsd-housekeeping
File size:	51840 bytes
MD5 hash:	b55f3394a84976ddb92a2915e5d76914

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report fenty.arm5.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: fenty.arm5.elf PID: 6239, Parent PID: 6153

General

Chronological Activities

Analysis Process: fenty.arm5.elf PID: 6241, Parent PID: 6239

General

Chronological Activities

Analysis Process: fenty.arm5.elf PID: 6243, Parent PID: 6241

General

Chronological Activities

Analysis Process: fenty.arm5.elf PID: 6245, Parent PID: 6241

General

Chronological Activities

Analysis Process: gnome-session-binary PID: 6247, Parent PID: 1477

General

Chronological Activities

Analysis Process: sh PID: 6247, Parent PID: 1477

General

Chronological Activities

Analysis Process: gsd-housekeeping PID: 6247, Parent PID: 1477

General

Linux Analysis Report
fenty.arm5.elf