Edit tour

Linux Analysis Report
wind.spc.elf

Overview

General Information

Sample name:	wind.spc.elf
Analysis ID:	1583530
MD5:	7899eb707c0fbfaafc8dcdc81ecf698c
SHA1:	1f93e03091425ba031217366adcfe7445f1bfaa1
SHA256:	5cdfc6cd301638ca4cc3c0537017ea5aba1c1271a67fefdeb87cd93cfe809876
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	84
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample tries to kill multiple processes (SIGKILL)

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583530
Start date and time:	2025-01-03 00:12:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	wind.spc.elf
Detection:	MAL
Classification:	mal84.spre.troj.linELF@0/0@0/0

Warnings

VT rate limit hit for: wind.spc.elf

Runtime Messages

Command:	/tmp/wind.spc.elf
PID:	6238
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

wind.spc.elf (PID: 6238, Parent: 6145, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/wind.spc.elf

wind.spc.elf New Fork (PID: 6240, Parent: 6238)

wind.spc.elf New Fork (PID: 6241, Parent: 6238)

wind.spc.elf New Fork (PID: 6242, Parent: 6238)

xfce4-panel New Fork (PID: 6251, Parent: 2063)

wrapper-2.0 (PID: 6251, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 6252, Parent: 2063)

wrapper-2.0 (PID: 6252, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 6253, Parent: 2063)

wrapper-2.0 (PID: 6253, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 6254, Parent: 2063)

wrapper-2.0 (PID: 6254, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

xfce4-panel New Fork (PID: 6255, Parent: 2063)

wrapper-2.0 (PID: 6255, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 6256, Parent: 2063)

wrapper-2.0 (PID: 6256, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
wind.spc.elf	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
wind.spc.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
wind.spc.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xee58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeea8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeebc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeed0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeee4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeef8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefe8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
wind.spc.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xf3b8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
wind.spc.elf	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xeda0:$x1: POST /cdn-cgi/ 0xfbe8:$s1: LCOGQGPTGP
wind.spc.elf	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0xeda0:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6238.1.00007fc96c011000.00007fc96c022000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6238.1.00007fc96c011000.00007fc96c022000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6238.1.00007fc96c011000.00007fc96c022000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xee58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeea8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeebc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeed0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeee4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeef8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefe8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6238.1.00007fc96c011000.00007fc96c022000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xf3b8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6238.1.00007fc96c011000.00007fc96c022000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xeda0:$x1: POST /cdn-cgi/ 0xfbe8:$s1: LCOGQGPTGP
6238.1.00007fc96c011000.00007fc96c022000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0xeda0:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6241.1.00007fc96c011000.00007fc96c022000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6241.1.00007fc96c011000.00007fc96c022000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6241.1.00007fc96c011000.00007fc96c022000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xee58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeea8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeebc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeed0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeee4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeef8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xefe8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6241.1.00007fc96c011000.00007fc96c022000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xf3b8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6241.1.00007fc96c011000.00007fc96c022000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xeda0:$x1: POST /cdn-cgi/ 0xfbe8:$s1: LCOGQGPTGP
6241.1.00007fc96c011000.00007fc96c022000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0xeda0:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
Process Memory Space: wind.spc.elf PID: 6238	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: wind.spc.elf PID: 6238	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x22a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x230c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2320:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2334:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2348:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x235c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2370:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2384:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2398:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2410:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2424:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2438:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: wind.spc.elf PID: 6238	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x2766:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 10 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: wind.spc.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: wind.spc.elf

ReversingLabs: Detection: 71%

Source: global traffic

TCP traffic: 192.168.2.23:39040 -> 45.95.169.120:3778

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: wind.spc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: wind.spc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: wind.spc.elf, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: wind.spc.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6238.1.00007fc96c011000.00007fc96c022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6238.1.00007fc96c011000.00007fc96c022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6238.1.00007fc96c011000.00007fc96c022000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6238.1.00007fc96c011000.00007fc96c022000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6241.1.00007fc96c011000.00007fc96c022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6241.1.00007fc96c011000.00007fc96c022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6241.1.00007fc96c011000.00007fc96c022000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6241.1.00007fc96c011000.00007fc96c022000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: Process Memory Space: wind.spc.elf PID: 6238, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: wind.spc.elf PID: 6238, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 6251, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 6252, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 6253, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 6254, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 6255, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 6256, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 6251, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 6252, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 6253, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 6254, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 6255, result: successful	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	SIGKILL sent: pid: 6256, result: successful	Jump to behavior

Source: wind.spc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: wind.spc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: wind.spc.elf, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: wind.spc.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6238.1.00007fc96c011000.00007fc96c022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6238.1.00007fc96c011000.00007fc96c022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6238.1.00007fc96c011000.00007fc96c022000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6238.1.00007fc96c011000.00007fc96c022000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6241.1.00007fc96c011000.00007fc96c022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6241.1.00007fc96c011000.00007fc96c022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6241.1.00007fc96c011000.00007fc96c022000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6241.1.00007fc96c011000.00007fc96c022000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: Process Memory Space: wind.spc.elf PID: 6238, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: wind.spc.elf PID: 6238, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal84.spre.troj.linELF@0/0@0/0

Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/6196/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/2033/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/2275/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/6190/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1612/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/3236/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/2025/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/2146/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/4444/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/4445/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/4446/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/517/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/759/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/4447/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/6242/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/2285/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/2281/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1623/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/761/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1622/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/884/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1983/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/2038/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/2156/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1629/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1627/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/6252/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/6251/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/6254/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/6253/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/6256/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/6255/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/3021/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/2294/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/2050/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1877/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/4508/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/772/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1633/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1632/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/774/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/654/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/896/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1872/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/2048/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/655/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/2289/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/656/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/777/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/657/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/658/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/419/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1639/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1638/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/2180/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1494/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1890/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/2063/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/2062/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1888/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1886/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/420/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1489/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/785/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1642/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/788/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/667/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/789/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/4477/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/4479/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/1648/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/2078/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/2077/cmdline	Jump to behavior
Source: /tmp/wind.spc.elf (PID: 6240)	File opened: /proc/2074/cmdline	Jump to behavior

Source: /tmp/wind.spc.elf (PID: 6238)

Queries kernel information via 'uname':

Jump to behavior

Source: wind.spc.elf, 6238.1.0000556963a29000.0000556963aae000.rw-.sdmp, wind.spc.elf, 6241.1.0000556963a29000.0000556963aae000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: wind.spc.elf, 6238.1.00007fff39bc9000.00007fff39bea000.rw-.sdmp, wind.spc.elf, 6241.1.00007fff39bc9000.00007fff39bea000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/wind.spc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/wind.spc.elf
Source: wind.spc.elf, 6238.1.0000556963a29000.0000556963aae000.rw-.sdmp, wind.spc.elf, 6241.1.0000556963a29000.0000556963aae000.rw-.sdmp	Binary or memory string: ciU!/etc/qemu-binfmt/sparc
Source: wind.spc.elf, 6238.1.00007fff39bc9000.00007fff39bea000.rw-.sdmp, wind.spc.elf, 6241.1.00007fff39bc9000.00007fff39bea000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: wind.spc.elf, type: SAMPLE
Source: Yara match	File source: 6238.1.00007fc96c011000.00007fc96c022000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6241.1.00007fc96c011000.00007fc96c022000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wind.spc.elf PID: 6238, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: wind.spc.elf, type: SAMPLE
Source: Yara match	File source: 6238.1.00007fc96c011000.00007fc96c022000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6241.1.00007fc96c011000.00007fc96c022000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wind.spc.elf PID: 6238, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
wind.spc.elf	71%	ReversingLabs	Linux.Trojan.Mirai
wind.spc.elf	100%	Avira	EXP/ELF.Gafgyt.Z.F

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
45.95.169.120	unknown	Croatia (LOCAL Name: Hrvatska)	42864	GIGANET-HUGigaNetInternetServiceProviderCoHU	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.95.169.120	wind.ppc.elf	Get hash	malicious	Mirai	Browse
	wind.sh4.elf	Get hash	malicious	Mirai	Browse
	wind.mips.elf	Get hash	malicious	Mirai	Browse
	wind.arm.elf	Get hash	malicious	Mirai	Browse
	wind.sh4.elf	Get hash	malicious	Mirai	Browse
	ppc.elf	Get hash	malicious	Mirai	Browse
	wind.spc.elf	Get hash	malicious	Mirai	Browse
	wind.mpsl.elf	Get hash	malicious	Mirai	Browse
	wind.arm7.elf	Get hash	malicious	Mirai	Browse
	m68k.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	wind.ppc.elf	Get hash	malicious	Mirai	Browse
	wind.mips.elf	Get hash	malicious	Mirai	Browse
	wind.arm6.elf	Get hash	malicious	Mirai	Browse
	wind.arm.elf	Get hash	malicious	Mirai	Browse
	arm.elf	Get hash	malicious	Unknown	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse
	nn.elf	Get hash	malicious	Nanominer, Xmrig	Browse
	i.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	ZohoAssistURS	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	wind.ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wind.sh4.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	wind.arc.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	wind.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wind.arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wind.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	nn.elf	Get hash	malicious	Nanominer, Xmrig	Browse	91.189.91.42
	i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
CANONICAL-ASGB	wind.ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wind.sh4.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	wind.arc.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	wind.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wind.arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wind.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	nn.elf	Get hash	malicious	Nanominer, Xmrig	Browse	91.189.91.42
	i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
GIGANET-HUGigaNetInternetServiceProviderCoHU	wind.ppc.elf	Get hash	malicious	Mirai	Browse	45.95.169.120
	wind.sh4.elf	Get hash	malicious	Mirai	Browse	45.95.169.120
	wind.mips.elf	Get hash	malicious	Mirai	Browse	45.95.169.120
	wind.arm.elf	Get hash	malicious	Mirai	Browse	45.95.169.120
	wind.sh4.elf	Get hash	malicious	Mirai	Browse	45.95.169.120
	ppc.elf	Get hash	malicious	Mirai	Browse	45.95.169.120
	wind.spc.elf	Get hash	malicious	Mirai	Browse	45.95.169.120
	wind.mpsl.elf	Get hash	malicious	Mirai	Browse	45.95.169.120
	wind.arm7.elf	Get hash	malicious	Mirai	Browse	45.95.169.120
	m68k.elf	Get hash	malicious	Mirai	Browse	45.95.169.120
INIT7CH	wind.ppc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	wind.mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	wind.arm6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	wind.arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	arm.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	arm5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	nn.elf	Get hash	malicious	Nanominer, Xmrig	Browse	109.202.202.202
	i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	ZohoAssistURS	Get hash	malicious	Unknown	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.168146068522561
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	wind.spc.elf
File size:	67'560 bytes
MD5:	7899eb707c0fbfaafc8dcdc81ecf698c
SHA1:	1f93e03091425ba031217366adcfe7445f1bfaa1
SHA256:	5cdfc6cd301638ca4cc3c0537017ea5aba1c1271a67fefdeb87cd93cfe809876
SHA512:	c91f37bdf0a55b78d3369dd0e195dc717ca45112c97781bea61a5821834ad794d6c70d399c5623ab4d409346570f28f4ed7620b60e0ee82b2b4d29586ac573e7
SSDEEP:	1536:nuJygQcTjUM3QB/nJe4cVX0yTwp/l9lQ9KNGImGbp:uJibgqp/e9FIfbp
TLSH:	F6634A21B93A1F13D0E4A47E21FB975AB1E15ACE2294C64E7E720E9FFF2154458438F8
File Content Preview:	.ELF...........................4...X.....4. ...(.......................................................4............dt.Q................................@..(....@.;(................#.....b...`.....!.....#...@.....".........`......$#...#...@...........`....

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101a4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	67160
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	4
.text	PROGBITS	0x100b0	0xb0	0xecd8	0x0	0x6	AX	4
.fini	PROGBITS	0x1ed88	0xed88	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x1eda0	0xeda0	0x1640	0x0	0x2	A	8
.ctors	PROGBITS	0x303e4	0x103e4	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x303ec	0x103ec	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x303f8	0x103f8	0x220	0x0	0x3	WA	8
.bss	NOBITS	0x30618	0x10618	0x378	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x10618	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0x103e0	0x103e0	6.1924	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x103e4	0x303e4	0x303e4	0x234	0x5ac	2.9535	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 00:12:47.099684000 CET	39040	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:47.106021881 CET	3778	39040	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:47.106096029 CET	39040	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:47.109638929 CET	39040	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:47.116005898 CET	3778	39040	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:47.116050959 CET	39040	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:47.122606039 CET	3778	39040	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:47.759501934 CET	3778	39040	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:47.759568930 CET	39040	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:47.759706020 CET	39040	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:47.762758017 CET	39042	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:47.768845081 CET	3778	39042	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:47.768892050 CET	39042	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:47.776825905 CET	39042	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:47.783238888 CET	3778	39042	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:47.783286095 CET	39042	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:47.789419889 CET	3778	39042	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:48.535590887 CET	3778	39042	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:48.535644054 CET	39042	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:48.535681009 CET	39042	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:48.536269903 CET	39044	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:48.542725086 CET	3778	39044	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:48.542784929 CET	39044	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:48.543970108 CET	39044	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:48.550482988 CET	3778	39044	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:48.550554991 CET	39044	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:48.556708097 CET	3778	39044	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:49.065026999 CET	43928	443	192.168.2.23	91.189.91.42
Jan 3, 2025 00:12:49.194714069 CET	3778	39044	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:49.194807053 CET	39044	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:49.194807053 CET	39044	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:49.198093891 CET	39046	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:49.204186916 CET	3778	39046	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:49.204231977 CET	39046	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:49.205877066 CET	39046	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:49.211922884 CET	3778	39046	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:49.211960077 CET	39046	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:49.218050957 CET	3778	39046	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:49.865942001 CET	3778	39046	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:49.866015911 CET	39046	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:49.866039038 CET	39046	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:49.866596937 CET	39048	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:49.872692108 CET	3778	39048	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:49.872737885 CET	39048	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:49.874015093 CET	39048	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:49.880450010 CET	3778	39048	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:49.880497932 CET	39048	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:49.886550903 CET	3778	39048	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:51.529565096 CET	3778	39048	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:51.529625893 CET	39048	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:51.529661894 CET	39048	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:51.530437946 CET	39050	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:51.535226107 CET	3778	39050	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:51.535275936 CET	39050	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:51.537450075 CET	39050	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:51.542208910 CET	3778	39050	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:51.542248964 CET	39050	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:51.546977043 CET	3778	39050	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:52.202227116 CET	3778	39050	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:52.202403069 CET	39050	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:52.202403069 CET	39050	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:52.207451105 CET	39052	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:52.212286949 CET	3778	39052	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:52.212404013 CET	39052	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:52.261070967 CET	39052	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:52.265813112 CET	3778	39052	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:52.268935919 CET	39052	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:52.275742054 CET	3778	39052	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:52.864203930 CET	3778	39052	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:52.864377022 CET	39052	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:52.864377975 CET	39052	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:52.864778996 CET	39054	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:52.871151924 CET	3778	39054	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:52.871227980 CET	39054	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:52.872015953 CET	39054	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:52.878329992 CET	3778	39054	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:52.878377914 CET	39054	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:52.884831905 CET	3778	39054	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:53.533308029 CET	3778	39054	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:53.533490896 CET	39054	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:53.533492088 CET	39054	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:53.533862114 CET	39056	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:53.538688898 CET	3778	39056	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:53.538738966 CET	39056	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:53.539297104 CET	39056	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:53.544085026 CET	3778	39056	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:53.544121027 CET	39056	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:53.548938990 CET	3778	39056	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:54.192167997 CET	3778	39056	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:54.192359924 CET	39056	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:54.192359924 CET	39056	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:54.192693949 CET	39058	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:54.197438002 CET	3778	39058	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:54.197485924 CET	39058	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:54.198059082 CET	39058	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:54.202857018 CET	3778	39058	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:54.202896118 CET	39058	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:54.207726002 CET	3778	39058	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:54.695779085 CET	42836	443	192.168.2.23	91.189.91.43
Jan 3, 2025 00:12:54.868823051 CET	3778	39058	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:54.868994951 CET	39058	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:54.868994951 CET	39058	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:54.869271994 CET	39060	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:54.874036074 CET	3778	39060	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:54.874080896 CET	39060	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:54.874623060 CET	39060	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:54.879414082 CET	3778	39060	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:54.879451036 CET	39060	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:54.884212971 CET	3778	39060	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:55.553090096 CET	3778	39060	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:55.553251028 CET	39060	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:55.553251028 CET	39060	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:55.553509951 CET	39062	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:55.558315039 CET	3778	39062	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:55.558353901 CET	39062	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:55.558815956 CET	39062	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:55.563617945 CET	3778	39062	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:55.563652992 CET	39062	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:55.568401098 CET	3778	39062	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:56.210305929 CET	3778	39062	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:56.210489035 CET	39062	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:56.210489988 CET	39062	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:56.210766077 CET	39064	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:56.215610981 CET	3778	39064	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:56.215651989 CET	39064	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:56.216206074 CET	39064	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:56.220987082 CET	3778	39064	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:56.221021891 CET	39064	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:56.225780010 CET	3778	39064	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:56.231568098 CET	42516	80	192.168.2.23	109.202.202.202
Jan 3, 2025 00:12:56.867428064 CET	3778	39064	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:56.867573023 CET	39064	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:56.867573023 CET	39064	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:56.867855072 CET	39066	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:56.872591019 CET	3778	39066	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:56.872632980 CET	39066	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:56.873171091 CET	39066	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:56.877898932 CET	3778	39066	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:56.877934933 CET	39066	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:56.882818937 CET	3778	39066	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:58.533019066 CET	3778	39066	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:58.533211946 CET	39066	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:58.533211946 CET	39066	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:58.533631086 CET	39068	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:58.538408041 CET	3778	39068	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:58.538458109 CET	39068	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:58.539017916 CET	39068	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:58.543762922 CET	3778	39068	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:58.543806076 CET	39068	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:58.548609972 CET	3778	39068	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:59.214582920 CET	3778	39068	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:59.214792967 CET	39068	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:59.214793921 CET	39068	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:59.215089083 CET	39070	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:59.219904900 CET	3778	39070	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:59.219953060 CET	39070	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:59.220499992 CET	39070	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:59.225238085 CET	3778	39070	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:59.225275040 CET	39070	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:59.230104923 CET	3778	39070	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:59.890050888 CET	3778	39070	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:59.890204906 CET	39070	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:59.890204906 CET	39070	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:59.890520096 CET	39072	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:59.895344019 CET	3778	39072	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:59.895396948 CET	39072	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:59.895961046 CET	39072	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:59.900681973 CET	3778	39072	45.95.169.120	192.168.2.23
Jan 3, 2025 00:12:59.900823116 CET	39072	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:12:59.905565977 CET	3778	39072	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:00.575043917 CET	3778	39072	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:00.575226068 CET	39072	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:00.575226068 CET	39072	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:00.575536966 CET	39074	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:00.582088947 CET	3778	39074	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:00.582132101 CET	39074	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:00.582691908 CET	39074	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:00.588912964 CET	3778	39074	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:00.588957071 CET	39074	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:00.594938993 CET	3778	39074	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:04.234492064 CET	3778	39074	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:04.234632015 CET	39074	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:04.234690905 CET	39074	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:04.235363007 CET	39076	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:04.240222931 CET	3778	39076	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:04.240293026 CET	39076	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:04.241075993 CET	39076	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:04.245860100 CET	3778	39076	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:04.245965004 CET	39076	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:04.250821114 CET	3778	39076	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:04.925287962 CET	3778	39076	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:04.925479889 CET	39076	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:04.925479889 CET	39076	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:04.925884008 CET	39078	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:04.931979895 CET	3778	39078	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:04.932048082 CET	39078	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:04.932782888 CET	39078	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:04.939184904 CET	3778	39078	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:04.939239979 CET	39078	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:04.945836067 CET	3778	39078	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:05.699683905 CET	3778	39078	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:05.699883938 CET	39078	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:05.699883938 CET	39078	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:05.700373888 CET	39080	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:05.705142021 CET	3778	39080	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:05.705204010 CET	39080	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:05.705975056 CET	39080	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:05.710706949 CET	3778	39080	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:05.710761070 CET	39080	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:05.715516090 CET	3778	39080	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:06.473814964 CET	3778	39080	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:06.473898888 CET	39080	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:06.473922968 CET	39080	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:06.474462986 CET	39082	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:06.479248047 CET	3778	39082	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:06.479291916 CET	39082	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:06.479933023 CET	39082	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:06.484745979 CET	3778	39082	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:06.484782934 CET	39082	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:06.489614964 CET	3778	39082	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:07.254348040 CET	3778	39082	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:07.254431009 CET	39082	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:07.254458904 CET	39082	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:07.255052090 CET	39084	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:07.259862900 CET	3778	39084	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:07.259931087 CET	39084	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:07.260904074 CET	39084	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:07.265676975 CET	3778	39084	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:07.265717030 CET	39084	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:07.270471096 CET	3778	39084	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:07.910368919 CET	3778	39084	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:07.910429001 CET	39084	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:07.910510063 CET	39084	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:07.911108017 CET	39086	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:07.915891886 CET	3778	39086	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:07.915941000 CET	39086	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:07.916817904 CET	39086	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:07.921576977 CET	3778	39086	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:07.921636105 CET	39086	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:07.926390886 CET	3778	39086	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:08.571074009 CET	3778	39086	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:08.571252108 CET	39086	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:08.571252108 CET	39086	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:08.571666002 CET	39088	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:08.576525927 CET	3778	39088	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:08.576589108 CET	39088	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:08.577094078 CET	39088	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:08.581909895 CET	3778	39088	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:08.581950903 CET	39088	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:08.586740971 CET	3778	39088	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:09.226934910 CET	3778	39088	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:09.227051020 CET	39088	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:09.227102995 CET	39088	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:09.227699041 CET	39090	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:09.233920097 CET	3778	39090	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:09.233983040 CET	39090	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:09.234848976 CET	39090	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:09.241204023 CET	3778	39090	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:09.241252899 CET	39090	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:09.247282028 CET	3778	39090	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:09.797677994 CET	43928	443	192.168.2.23	91.189.91.42
Jan 3, 2025 00:13:09.896361113 CET	3778	39090	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:09.896457911 CET	39090	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:09.896522045 CET	39090	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:09.897057056 CET	39092	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:09.903110981 CET	3778	39092	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:09.903172970 CET	39092	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:09.904037952 CET	39092	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:09.910347939 CET	3778	39092	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:09.910398960 CET	39092	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:09.917016983 CET	3778	39092	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:10.556441069 CET	3778	39092	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:10.556557894 CET	39092	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:10.556602001 CET	39092	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:10.557018042 CET	39094	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:10.563162088 CET	3778	39094	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:10.563203096 CET	39094	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:10.563678980 CET	39094	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:10.569806099 CET	3778	39094	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:10.569850922 CET	39094	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:10.575948954 CET	3778	39094	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:11.236056089 CET	3778	39094	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:11.236108065 CET	39094	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:11.236269951 CET	39094	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:11.236485004 CET	39096	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:11.241271973 CET	3778	39096	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:11.241317987 CET	39096	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:11.241772890 CET	39096	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:11.246550083 CET	3778	39096	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:11.246587038 CET	39096	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:11.251372099 CET	3778	39096	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:11.902735949 CET	3778	39096	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:11.902837038 CET	39096	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:11.902837038 CET	39096	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:11.903218031 CET	39098	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:11.907990932 CET	3778	39098	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:11.908027887 CET	39098	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:11.908494949 CET	39098	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:11.914350033 CET	3778	39098	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:11.914383888 CET	39098	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:11.920445919 CET	3778	39098	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:12.887219906 CET	3778	39098	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:12.887404919 CET	39098	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:12.888065100 CET	39098	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:12.888699055 CET	39100	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:12.893594980 CET	3778	39100	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:12.893661022 CET	39100	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:12.894217014 CET	39100	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:12.898968935 CET	3778	39100	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:12.899008036 CET	39100	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:12.903837919 CET	3778	39100	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:13.573916912 CET	3778	39100	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:13.574079990 CET	39100	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:13.574166059 CET	39100	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:13.574783087 CET	39102	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:13.581079960 CET	3778	39102	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:13.581142902 CET	39102	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:13.582053900 CET	39102	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:13.588360071 CET	3778	39102	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:13.588409901 CET	39102	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:13.594907045 CET	3778	39102	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:14.263207912 CET	3778	39102	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:14.263493061 CET	39102	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:14.263494015 CET	39102	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:14.264194965 CET	39104	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:14.270278931 CET	3778	39104	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:14.270363092 CET	39104	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:14.271246910 CET	39104	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:14.277514935 CET	3778	39104	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:14.277556896 CET	39104	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:14.284075022 CET	3778	39104	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:14.942078114 CET	3778	39104	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:14.942295074 CET	39104	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:14.942295074 CET	39104	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:14.942883968 CET	39106	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:14.947644949 CET	3778	39106	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:14.947696924 CET	39106	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:14.948580027 CET	39106	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:14.953380108 CET	3778	39106	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:14.953422070 CET	39106	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:14.958164930 CET	3778	39106	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:15.608797073 CET	3778	39106	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:15.608891010 CET	39106	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:15.609066963 CET	39106	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:15.609535933 CET	39108	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:15.614381075 CET	3778	39108	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:15.614428043 CET	39108	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:15.615336895 CET	39108	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:15.620167971 CET	3778	39108	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:15.620207071 CET	39108	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:15.624984026 CET	3778	39108	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:16.265669107 CET	3778	39108	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:16.265836000 CET	39108	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:16.265950918 CET	39108	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:16.266688108 CET	39110	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:16.271487951 CET	3778	39110	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:16.271532059 CET	39110	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:16.272434950 CET	39110	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:16.277220964 CET	3778	39110	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:16.277257919 CET	39110	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:16.281986952 CET	3778	39110	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:16.922739029 CET	3778	39110	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:16.922925949 CET	39110	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:16.922925949 CET	39110	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:16.923185110 CET	39112	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:16.928067923 CET	3778	39112	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:16.928107977 CET	39112	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:16.928551912 CET	39112	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:16.933298111 CET	3778	39112	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:16.933331966 CET	39112	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:16.938064098 CET	3778	39112	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:17.579999924 CET	3778	39112	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:17.580101967 CET	39112	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:17.580159903 CET	39112	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:17.580806971 CET	39114	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:17.587219954 CET	3778	39114	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:17.587274075 CET	39114	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:17.588155985 CET	39114	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:17.594347000 CET	3778	39114	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:17.594383001 CET	39114	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:17.600457907 CET	3778	39114	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:18.240083933 CET	3778	39114	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:18.240175962 CET	39114	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:18.240247965 CET	39114	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:18.240884066 CET	39116	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:18.247854948 CET	3778	39116	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:18.247904062 CET	39116	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:18.248792887 CET	39116	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:18.254981995 CET	3778	39116	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:18.255017996 CET	39116	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:18.261076927 CET	3778	39116	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:21.930253983 CET	3778	39116	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:21.930351973 CET	39116	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:21.930427074 CET	39116	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:21.931077957 CET	39118	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:21.935844898 CET	3778	39118	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:21.935899019 CET	39118	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:21.937885046 CET	39118	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:21.942615032 CET	3778	39118	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:21.942656040 CET	39118	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:21.947367907 CET	3778	39118	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:22.083892107 CET	42836	443	192.168.2.23	91.189.91.43
Jan 3, 2025 00:13:22.586765051 CET	3778	39118	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:22.586853027 CET	39118	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:22.586910009 CET	39118	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:22.587491989 CET	39120	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:22.592263937 CET	3778	39120	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:22.592335939 CET	39120	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:22.593262911 CET	39120	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:22.598072052 CET	3778	39120	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:22.598143101 CET	39120	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:22.602998018 CET	3778	39120	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:23.252224922 CET	3778	39120	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:23.252356052 CET	39120	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:23.252422094 CET	39120	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:23.253051043 CET	39122	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:23.259018898 CET	3778	39122	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:23.259084940 CET	39122	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:23.260035038 CET	39122	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:23.265636921 CET	3778	39122	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:23.265707970 CET	39122	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:23.270522118 CET	3778	39122	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:23.914586067 CET	3778	39122	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:23.914711952 CET	39122	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:23.914808989 CET	39122	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:23.915467024 CET	39124	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:23.920245886 CET	3778	39124	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:23.920335054 CET	39124	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:23.921188116 CET	39124	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:23.925951004 CET	3778	39124	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:23.926006079 CET	39124	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:23.930866957 CET	3778	39124	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:24.651110888 CET	3778	39124	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:24.651220083 CET	39124	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:24.651262999 CET	39124	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:24.651845932 CET	39126	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:24.656681061 CET	3778	39126	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:24.656744957 CET	39126	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:24.657614946 CET	39126	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:24.662431002 CET	3778	39126	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:24.662487030 CET	39126	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:24.667242050 CET	3778	39126	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:25.335896969 CET	3778	39126	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:25.336004019 CET	39126	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:25.336047888 CET	39126	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:25.336555958 CET	39128	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:25.341392994 CET	3778	39128	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:25.341451883 CET	39128	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:25.342360020 CET	39128	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:25.347136974 CET	3778	39128	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:25.347187996 CET	39128	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:25.352018118 CET	3778	39128	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:26.001292944 CET	3778	39128	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:26.001446009 CET	39128	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:26.001530886 CET	39128	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:26.002192020 CET	39130	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:26.007026911 CET	3778	39130	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:26.007091045 CET	39130	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:26.007924080 CET	39130	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:26.012692928 CET	3778	39130	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:26.012761116 CET	39130	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:26.017602921 CET	3778	39130	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:26.179359913 CET	42516	80	192.168.2.23	109.202.202.202
Jan 3, 2025 00:13:26.692723036 CET	3778	39130	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:26.692796946 CET	39130	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:26.692796946 CET	39130	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:26.693095922 CET	39132	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:26.699412107 CET	3778	39132	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:26.699456930 CET	39132	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:26.699927092 CET	39132	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:26.705972910 CET	3778	39132	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:26.706013918 CET	39132	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:26.712002039 CET	3778	39132	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:27.368071079 CET	3778	39132	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:27.368153095 CET	39132	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:27.368153095 CET	39132	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:27.368459940 CET	39134	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:27.373260021 CET	3778	39134	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:27.373305082 CET	39134	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:27.373764992 CET	39134	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:27.378563881 CET	3778	39134	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:27.378598928 CET	39134	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:27.383327007 CET	3778	39134	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:28.027323961 CET	3778	39134	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:28.027471066 CET	39134	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:28.027553082 CET	39134	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:28.028204918 CET	39136	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:28.033021927 CET	3778	39136	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:28.033098936 CET	39136	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:28.033993006 CET	39136	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:28.038733006 CET	3778	39136	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:28.038774967 CET	39136	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:28.043560028 CET	3778	39136	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:28.713018894 CET	3778	39136	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:28.713092089 CET	39136	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:28.713150978 CET	39136	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:28.713685989 CET	39138	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:28.718528986 CET	3778	39138	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:28.718578100 CET	39138	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:28.719521046 CET	39138	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:28.724339008 CET	3778	39138	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:28.724376917 CET	39138	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:28.729193926 CET	3778	39138	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:29.368663073 CET	3778	39138	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:29.368738890 CET	39138	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:29.368738890 CET	39138	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:29.369040012 CET	39140	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:29.373843908 CET	3778	39140	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:29.373895884 CET	39140	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:29.374608040 CET	39140	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:29.379350901 CET	3778	39140	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:29.379398108 CET	39140	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:29.384200096 CET	3778	39140	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:30.045706034 CET	3778	39140	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:30.045785904 CET	39140	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:30.045880079 CET	39140	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:30.046506882 CET	39142	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:30.051276922 CET	3778	39142	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:30.051331997 CET	39142	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:30.052222967 CET	39142	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:30.056962013 CET	3778	39142	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:30.057003021 CET	39142	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:30.061791897 CET	3778	39142	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:30.701793909 CET	3778	39142	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:30.701874971 CET	39142	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:30.701908112 CET	39142	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:30.702421904 CET	39144	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:30.707191944 CET	3778	39144	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:30.707236052 CET	39144	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:30.708093882 CET	39144	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:30.712853909 CET	3778	39144	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:30.712891102 CET	39144	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:30.717647076 CET	3778	39144	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:31.370162964 CET	3778	39144	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:31.370239973 CET	39144	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:31.370270014 CET	39144	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:31.370794058 CET	39146	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:31.375646114 CET	3778	39146	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:31.375694036 CET	39146	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:31.376554966 CET	39146	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:31.381288052 CET	3778	39146	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:31.381328106 CET	39146	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:31.386213064 CET	3778	39146	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:32.356260061 CET	3778	39146	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:32.356349945 CET	39146	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:32.356431007 CET	39146	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:32.357038975 CET	39148	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:32.361867905 CET	3778	39148	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:32.361922979 CET	39148	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:32.362857103 CET	39148	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:32.367634058 CET	3778	39148	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:32.367671967 CET	39148	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:32.372489929 CET	3778	39148	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:33.031450987 CET	3778	39148	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:33.031547070 CET	39148	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:33.031606913 CET	39148	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:33.032233953 CET	39150	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:33.038300991 CET	3778	39150	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:33.038371086 CET	39150	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:33.039264917 CET	39150	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:33.045614958 CET	3778	39150	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:33.045654058 CET	39150	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:33.052154064 CET	3778	39150	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:33.707628012 CET	3778	39150	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:33.707711935 CET	39150	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:33.707767010 CET	39150	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:33.708312035 CET	39152	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:33.715358019 CET	3778	39152	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:33.715429068 CET	39152	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:33.716336966 CET	39152	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:33.722979069 CET	3778	39152	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:33.723033905 CET	39152	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:33.729641914 CET	3778	39152	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:35.391472101 CET	3778	39152	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:35.391629934 CET	39152	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:35.391705990 CET	39152	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:35.392298937 CET	39154	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:35.400016069 CET	3778	39154	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:35.400083065 CET	39154	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:35.401020050 CET	39154	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:35.408551931 CET	3778	39154	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:35.408611059 CET	39154	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:35.416167021 CET	3778	39154	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:39.057023048 CET	3778	39154	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:39.057199001 CET	39154	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:39.057288885 CET	39154	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:39.057962894 CET	39156	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:39.062798977 CET	3778	39156	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:39.062869072 CET	39156	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:39.063766956 CET	39156	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:39.068475962 CET	3778	39156	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:39.068545103 CET	39156	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:39.073322058 CET	3778	39156	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:39.722115040 CET	3778	39156	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:39.722269058 CET	39156	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:39.722335100 CET	39156	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:39.722959042 CET	39158	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:39.727773905 CET	3778	39158	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:39.727839947 CET	39158	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:39.728730917 CET	39158	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:39.733474970 CET	3778	39158	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:39.733544111 CET	39158	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:39.738290071 CET	3778	39158	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:40.387353897 CET	3778	39158	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:40.387447119 CET	39158	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:40.387476921 CET	39158	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:40.387875080 CET	39160	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:40.392659903 CET	3778	39160	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:40.392745018 CET	39160	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:40.393430948 CET	39160	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:40.398241997 CET	3778	39160	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:40.398274899 CET	39160	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:40.403634071 CET	3778	39160	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:41.044233084 CET	3778	39160	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:41.044342041 CET	39160	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:41.044370890 CET	39160	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:41.044751883 CET	39162	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:41.049487114 CET	3778	39162	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:41.049530029 CET	39162	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:41.050040960 CET	39162	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:41.054748058 CET	3778	39162	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:41.054806948 CET	39162	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:41.059556007 CET	3778	39162	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:41.703501940 CET	3778	39162	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:41.703592062 CET	39162	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:41.703620911 CET	39162	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:41.703983068 CET	39164	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:41.710493088 CET	3778	39164	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:41.710539103 CET	39164	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:41.711026907 CET	39164	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:41.717170954 CET	3778	39164	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:41.717207909 CET	39164	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:41.723191977 CET	3778	39164	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:42.371794939 CET	3778	39164	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:42.371889114 CET	39164	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:42.371910095 CET	39164	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:42.372215033 CET	39166	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:42.378377914 CET	3778	39166	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:42.378423929 CET	39166	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:42.378904104 CET	39166	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:42.384996891 CET	3778	39166	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:42.385036945 CET	39166	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:42.391134024 CET	3778	39166	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:43.030556917 CET	3778	39166	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:43.030668020 CET	39166	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:43.030693054 CET	39166	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:43.031028986 CET	39168	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:43.035860062 CET	3778	39168	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:43.035933971 CET	39168	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:43.036422968 CET	39168	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:43.041228056 CET	3778	39168	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:43.041286945 CET	39168	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:43.046129942 CET	3778	39168	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:43.687406063 CET	3778	39168	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:43.687467098 CET	39168	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:43.687483072 CET	39168	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:43.687834978 CET	39170	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:43.692627907 CET	3778	39170	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:43.692672968 CET	39170	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:43.693197966 CET	39170	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:43.697942019 CET	3778	39170	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:43.697981119 CET	39170	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:43.702775955 CET	3778	39170	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:44.343235970 CET	3778	39170	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:44.343307972 CET	39170	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:44.343333006 CET	39170	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:44.343688011 CET	39172	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:44.348442078 CET	3778	39172	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:44.348505974 CET	39172	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:44.349005938 CET	39172	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:44.353771925 CET	3778	39172	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:44.353810072 CET	39172	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:44.358575106 CET	3778	39172	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:45.020514011 CET	3778	39172	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:45.020597935 CET	39172	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:45.020627975 CET	39172	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:45.021009922 CET	39174	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:45.025914907 CET	3778	39174	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:45.025959969 CET	39174	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:45.026446104 CET	39174	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:45.031218052 CET	3778	39174	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:45.031255960 CET	39174	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:45.035969973 CET	3778	39174	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:45.697586060 CET	3778	39174	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:45.697669983 CET	39174	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:45.697694063 CET	39174	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:45.698066950 CET	39176	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:45.704632998 CET	3778	39176	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:45.704687119 CET	39176	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:45.705163002 CET	39176	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:45.711278915 CET	3778	39176	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:45.711332083 CET	39176	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:45.717377901 CET	3778	39176	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:46.356573105 CET	3778	39176	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:46.356638908 CET	39176	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:46.356666088 CET	39176	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:46.356973886 CET	39178	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:46.361763000 CET	3778	39178	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:46.361809969 CET	39178	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:46.362307072 CET	39178	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:46.367155075 CET	3778	39178	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:46.367208004 CET	39178	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:46.371977091 CET	3778	39178	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:47.021306038 CET	3778	39178	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:47.021373034 CET	39178	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:47.021403074 CET	39178	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:47.021704912 CET	39180	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:47.026514053 CET	3778	39180	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:47.026551962 CET	39180	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:47.026995897 CET	39180	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:47.031764030 CET	3778	39180	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:47.031797886 CET	39180	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:47.036609888 CET	3778	39180	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:47.680577040 CET	3778	39180	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:47.680645943 CET	39180	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:47.680732012 CET	39180	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:47.681381941 CET	39182	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:47.686105013 CET	3778	39182	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:47.686150074 CET	39182	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:47.687089920 CET	39182	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:47.691893101 CET	3778	39182	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:47.691931009 CET	39182	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:47.696679115 CET	3778	39182	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:48.365421057 CET	3778	39182	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:48.365492105 CET	39182	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:48.365547895 CET	39182	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:48.366086960 CET	39184	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:48.370933056 CET	3778	39184	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:48.371014118 CET	39184	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:48.371938944 CET	39184	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:48.376744986 CET	3778	39184	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:48.376796007 CET	39184	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:48.381588936 CET	3778	39184	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:49.127701044 CET	3778	39184	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:49.127790928 CET	39184	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:49.127827883 CET	39184	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:49.128181934 CET	39186	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:49.134438992 CET	3778	39186	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:49.134491920 CET	39186	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:49.135400057 CET	39186	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:49.141504049 CET	3778	39186	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:49.141570091 CET	39186	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:49.147674084 CET	3778	39186	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:49.786448002 CET	3778	39186	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:49.786585093 CET	39186	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:49.786676884 CET	39186	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:49.787282944 CET	39188	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:49.793469906 CET	3778	39188	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:49.793540955 CET	39188	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:49.794424057 CET	39188	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:49.801160097 CET	3778	39188	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:49.801238060 CET	39188	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:49.807851076 CET	3778	39188	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:50.449755907 CET	3778	39188	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:50.449886084 CET	39188	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:50.449990988 CET	39188	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:50.450689077 CET	39190	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:50.457746983 CET	3778	39190	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:50.457813025 CET	39190	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:50.458689928 CET	39190	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:50.465586901 CET	3778	39190	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:50.465645075 CET	39190	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:50.472524881 CET	3778	39190	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:50.751950026 CET	43928	443	192.168.2.23	91.189.91.42
Jan 3, 2025 00:13:51.110441923 CET	3778	39190	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:51.110583067 CET	39190	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:51.110622883 CET	39190	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:51.111221075 CET	39192	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:51.118097067 CET	3778	39192	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:51.118161917 CET	39192	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:51.119072914 CET	39192	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:51.125821114 CET	3778	39192	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:51.125881910 CET	39192	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:51.132519960 CET	3778	39192	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:51.773696899 CET	3778	39192	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:51.773844957 CET	39192	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:51.773932934 CET	39192	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:51.774612904 CET	39194	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:51.781409979 CET	3778	39194	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:51.781474113 CET	39194	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:51.782401085 CET	39194	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:51.789103985 CET	3778	39194	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:51.789160013 CET	39194	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:51.795838118 CET	3778	39194	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:52.438190937 CET	3778	39194	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:52.438477039 CET	39194	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:52.438477039 CET	39194	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:52.438940048 CET	39196	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:52.443703890 CET	3778	39196	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:52.443761110 CET	39196	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:52.444611073 CET	39196	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:52.449381113 CET	3778	39196	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:52.449433088 CET	39196	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:52.454325914 CET	3778	39196	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:54.308967113 CET	3778	39196	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:54.309137106 CET	39196	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:54.309197903 CET	39196	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:54.309798956 CET	39198	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:54.314625978 CET	3778	39198	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:54.314694881 CET	39198	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:54.315618038 CET	39198	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:54.320421934 CET	3778	39198	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:54.320471048 CET	39198	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:54.325309038 CET	3778	39198	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:55.070453882 CET	3778	39198	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:55.070578098 CET	39198	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:55.070600033 CET	39198	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:55.071084976 CET	39200	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:55.075891018 CET	3778	39200	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:55.075964928 CET	39200	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:55.076818943 CET	39200	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:55.081644058 CET	3778	39200	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:55.081686020 CET	39200	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:55.086509943 CET	3778	39200	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:55.727427006 CET	3778	39200	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:55.727525949 CET	39200	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:55.727525949 CET	39200	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:55.727926970 CET	39202	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:55.732712984 CET	3778	39202	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:55.732758999 CET	39202	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:55.733648062 CET	39202	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:55.738403082 CET	3778	39202	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:55.738442898 CET	39202	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:55.743202925 CET	3778	39202	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:56.392828941 CET	3778	39202	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:56.392939091 CET	39202	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:56.392965078 CET	39202	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:56.393543959 CET	39204	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:56.398341894 CET	3778	39204	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:56.398391008 CET	39204	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:56.399307966 CET	39204	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:56.404109955 CET	3778	39204	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:56.404151917 CET	39204	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:56.408979893 CET	3778	39204	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:57.070024014 CET	3778	39204	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:57.070086002 CET	39204	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:57.070143938 CET	39204	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:57.070633888 CET	39206	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:57.075449944 CET	3778	39206	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:57.075498104 CET	39206	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:57.076200008 CET	39206	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:57.081007957 CET	3778	39206	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:57.081051111 CET	39206	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:57.085877895 CET	3778	39206	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:57.755748987 CET	3778	39206	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:57.755866051 CET	39206	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:57.755866051 CET	39206	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:57.756230116 CET	39208	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:57.762003899 CET	3778	39208	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:57.762047052 CET	39208	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:57.762521982 CET	39208	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:57.768796921 CET	3778	39208	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:57.768830061 CET	39208	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:57.775037050 CET	3778	39208	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:59.427510023 CET	3778	39208	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:59.427608967 CET	39208	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:59.427642107 CET	39208	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:59.428061962 CET	39210	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:59.432856083 CET	3778	39210	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:59.432907104 CET	39210	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:59.433363914 CET	39210	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:59.438138008 CET	3778	39210	45.95.169.120	192.168.2.23
Jan 3, 2025 00:13:59.438186884 CET	39210	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:13:59.443031073 CET	3778	39210	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:01.284111977 CET	3778	39210	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:01.284212112 CET	39210	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:01.284250975 CET	39210	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:01.284739971 CET	39212	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:01.289551973 CET	3778	39212	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:01.289601088 CET	39212	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:01.290147066 CET	39212	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:01.294883013 CET	3778	39212	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:01.294922113 CET	39212	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:01.299738884 CET	3778	39212	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:01.940237045 CET	3778	39212	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:01.940310955 CET	39212	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:01.940331936 CET	39212	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:01.940702915 CET	39214	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:01.946449995 CET	3778	39214	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:01.946499109 CET	39214	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:01.947043896 CET	39214	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:01.953118086 CET	3778	39214	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:01.953157902 CET	39214	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:01.959224939 CET	3778	39214	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:02.603219032 CET	3778	39214	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:02.603327036 CET	39214	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:02.603364944 CET	39214	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:02.603890896 CET	39216	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:02.609632969 CET	3778	39216	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:02.609685898 CET	39216	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:02.610234976 CET	39216	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:02.616246939 CET	3778	39216	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:02.616292000 CET	39216	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:02.622349977 CET	3778	39216	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:03.271416903 CET	3778	39216	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:03.271506071 CET	39216	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:03.271539927 CET	39216	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:03.271939039 CET	39218	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:03.276732922 CET	3778	39218	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:03.276778936 CET	39218	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:03.277312994 CET	39218	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:03.282041073 CET	3778	39218	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:03.282114029 CET	39218	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:03.286957979 CET	3778	39218	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:03.955574036 CET	3778	39218	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:03.955660105 CET	39218	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:03.955683947 CET	39218	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:03.956088066 CET	39220	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:03.960887909 CET	3778	39220	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:03.960967064 CET	39220	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:03.961616993 CET	39220	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:03.966334105 CET	3778	39220	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:03.966375113 CET	39220	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:03.971167088 CET	3778	39220	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:05.847704887 CET	3778	39220	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:05.847831964 CET	39220	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:05.847870111 CET	39220	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:05.848328114 CET	39222	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:05.854481936 CET	3778	39222	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:05.854578018 CET	39222	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:05.855191946 CET	39222	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:05.861691952 CET	3778	39222	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:05.861732006 CET	39222	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:05.867362022 CET	3778	39222	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:06.530179024 CET	3778	39222	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:06.530298948 CET	39222	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:06.530339003 CET	39222	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:06.530708075 CET	39224	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:06.535501957 CET	3778	39224	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:06.535550117 CET	39224	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:06.536066055 CET	39224	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:06.540808916 CET	3778	39224	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:06.540872097 CET	39224	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:06.545747042 CET	3778	39224	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:07.204902887 CET	3778	39224	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:07.205048084 CET	39224	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:07.205127001 CET	39224	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:07.205741882 CET	39226	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:07.211208105 CET	3778	39226	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:07.211277962 CET	39226	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:07.212172031 CET	39226	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:07.217879057 CET	3778	39226	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:07.217931986 CET	39226	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:07.222732067 CET	3778	39226	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:07.872457981 CET	3778	39226	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:07.872570992 CET	39226	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:07.872621059 CET	39226	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:07.873181105 CET	39228	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:07.878041029 CET	3778	39228	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:07.878102064 CET	39228	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:07.878993988 CET	39228	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:07.883799076 CET	3778	39228	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:07.883851051 CET	39228	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:07.888645887 CET	3778	39228	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:08.530210018 CET	3778	39228	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:08.530308008 CET	39228	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:08.530329943 CET	39228	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:08.530733109 CET	39230	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:08.535469055 CET	3778	39230	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:08.535507917 CET	39230	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:08.535970926 CET	39230	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:08.541018009 CET	3778	39230	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:08.541052103 CET	39230	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:08.546447039 CET	3778	39230	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:09.207410097 CET	3778	39230	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:09.207571983 CET	39230	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:09.207653046 CET	39230	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:09.208267927 CET	39232	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:09.215589046 CET	3778	39232	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:09.215670109 CET	39232	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:09.216537952 CET	39232	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:09.223295927 CET	3778	39232	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:09.223342896 CET	39232	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:09.229484081 CET	3778	39232	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:09.981946945 CET	3778	39232	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:09.982048035 CET	39232	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:09.982078075 CET	39232	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:09.982641935 CET	39234	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:09.988981009 CET	3778	39234	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:09.989032030 CET	39234	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:09.989814997 CET	39234	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:09.996176958 CET	3778	39234	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:09.996222019 CET	39234	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:10.002840996 CET	3778	39234	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:12.067950010 CET	3778	39234	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:12.068063021 CET	39234	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:12.068197966 CET	39234	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:12.069008112 CET	39236	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:12.075248003 CET	3778	39236	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:12.075304985 CET	39236	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:12.076250076 CET	39236	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:12.082508087 CET	3778	39236	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:12.082550049 CET	39236	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:12.088788986 CET	3778	39236	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:14.785506964 CET	3778	39236	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:14.785599947 CET	39236	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:14.785634041 CET	39236	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:14.786075115 CET	39238	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:14.792140961 CET	3778	39238	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:14.792193890 CET	39238	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:14.792697906 CET	39238	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:14.798824072 CET	3778	39238	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:14.798862934 CET	39238	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:14.805413008 CET	3778	39238	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:15.443789005 CET	3778	39238	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:15.443867922 CET	39238	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:15.443897009 CET	39238	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:15.444261074 CET	39240	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:15.449090004 CET	3778	39240	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:15.449137926 CET	39240	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:15.449613094 CET	39240	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:15.454372883 CET	3778	39240	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:15.454410076 CET	39240	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:15.459214926 CET	3778	39240	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:16.128143072 CET	3778	39240	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:16.128225088 CET	39240	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:16.128273010 CET	39240	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:16.128743887 CET	39242	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:16.133454084 CET	3778	39242	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:16.133505106 CET	39242	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:16.134248972 CET	39242	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:16.138967991 CET	3778	39242	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:16.139005899 CET	39242	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:16.143759012 CET	3778	39242	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:16.797852039 CET	3778	39242	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:16.797949076 CET	39242	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:16.797949076 CET	39242	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:16.798300982 CET	39244	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:16.804719925 CET	3778	39244	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:16.804770947 CET	39244	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:16.805273056 CET	39244	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:16.811610937 CET	3778	39244	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:16.811647892 CET	39244	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:16.817555904 CET	3778	39244	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:18.492183924 CET	3778	39244	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:18.492285967 CET	39244	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:18.492331028 CET	39244	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:18.492919922 CET	39246	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:18.497673988 CET	3778	39246	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:18.497741938 CET	39246	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:18.498642921 CET	39246	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:18.503350973 CET	3778	39246	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:18.503407001 CET	39246	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:18.508246899 CET	3778	39246	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:19.188672066 CET	3778	39246	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:19.188756943 CET	39246	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:19.188756943 CET	39246	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:19.189079046 CET	39248	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:19.194561005 CET	3778	39248	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:19.194619894 CET	39248	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:19.195101976 CET	39248	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:19.199886084 CET	3778	39248	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:19.199917078 CET	39248	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:19.206233025 CET	3778	39248	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:19.856426001 CET	3778	39248	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:19.856576920 CET	39248	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:19.856674910 CET	39248	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:19.857364893 CET	39250	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:19.864281893 CET	3778	39250	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:19.864348888 CET	39250	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:19.865262032 CET	39250	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:19.871759892 CET	3778	39250	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:19.871819019 CET	39250	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:19.877912998 CET	3778	39250	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:20.538683891 CET	3778	39250	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:20.538791895 CET	39250	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:20.538831949 CET	39250	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:20.539228916 CET	39252	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:20.545608044 CET	3778	39252	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:20.545660019 CET	39252	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:20.546210051 CET	39252	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:20.552272081 CET	3778	39252	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:20.552326918 CET	39252	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:20.558490992 CET	3778	39252	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:21.205549002 CET	3778	39252	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:21.205683947 CET	39252	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:21.205707073 CET	39252	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:21.206231117 CET	39254	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:21.212629080 CET	3778	39254	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:21.212676048 CET	39254	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:21.213278055 CET	39254	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:21.219820976 CET	3778	39254	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:21.219861984 CET	39254	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:21.225934982 CET	3778	39254	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:21.998096943 CET	3778	39254	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:21.998214006 CET	39254	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:21.998253107 CET	39254	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:21.998822927 CET	39256	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:22.005383015 CET	3778	39256	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:22.005431890 CET	39256	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:22.006061077 CET	39256	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:22.012641907 CET	3778	39256	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:22.012686014 CET	39256	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:22.019292116 CET	3778	39256	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:22.668102026 CET	3778	39256	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:22.668215036 CET	39256	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:22.668246984 CET	39256	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:22.668689966 CET	39258	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:22.675714016 CET	3778	39258	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:22.675769091 CET	39258	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:22.676384926 CET	39258	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:22.682894945 CET	3778	39258	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:22.682940960 CET	39258	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:22.689546108 CET	3778	39258	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:23.328639030 CET	3778	39258	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:23.328778028 CET	39258	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:23.328821898 CET	39258	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:23.329374075 CET	39260	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:23.336312056 CET	3778	39260	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:23.336363077 CET	39260	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:23.337043047 CET	39260	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:23.343709946 CET	3778	39260	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:23.343765974 CET	39260	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:23.350639105 CET	3778	39260	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:26.229275942 CET	3778	39260	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:26.229379892 CET	39260	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:26.229412079 CET	39260	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:26.229816914 CET	39262	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:26.234554052 CET	3778	39262	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:26.234601021 CET	39262	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:26.235100031 CET	39262	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:26.239911079 CET	3778	39262	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:26.239958048 CET	39262	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:26.244755030 CET	3778	39262	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:26.886851072 CET	3778	39262	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:26.886970043 CET	39262	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:26.887037992 CET	39262	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:26.887600899 CET	39264	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:26.892400980 CET	3778	39264	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:26.892473936 CET	39264	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:26.893394947 CET	39264	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:26.898381948 CET	3778	39264	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:26.898422003 CET	39264	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:26.903217077 CET	3778	39264	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:27.579065084 CET	3778	39264	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:27.579145908 CET	39264	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:27.579202890 CET	39264	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:27.579838037 CET	39266	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:27.586590052 CET	3778	39266	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:27.586644888 CET	39266	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:27.587146997 CET	39266	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:27.593843937 CET	3778	39266	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:27.593884945 CET	39266	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:27.600450039 CET	3778	39266	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:28.260812044 CET	3778	39266	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:28.260900021 CET	39266	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:28.260931969 CET	39266	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:28.261281967 CET	39268	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:28.269197941 CET	3778	39268	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:28.269251108 CET	39268	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:28.269761086 CET	39268	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:28.277276039 CET	3778	39268	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:28.277318001 CET	39268	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:28.283766985 CET	3778	39268	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:28.932128906 CET	3778	39268	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:28.932213068 CET	39268	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:28.932214022 CET	39268	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:28.932631016 CET	39270	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:28.938734055 CET	3778	39270	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:28.938781977 CET	39270	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:28.939719915 CET	39270	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:28.945926905 CET	3778	39270	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:28.945965052 CET	39270	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:28.952564955 CET	3778	39270	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:29.696590900 CET	3778	39270	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:29.696660995 CET	39270	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:29.696660995 CET	39270	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:29.696971893 CET	39272	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:29.703417063 CET	3778	39272	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:29.703469038 CET	39272	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:29.704386950 CET	39272	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:29.710573912 CET	3778	39272	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:29.710612059 CET	39272	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:29.716660023 CET	3778	39272	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:31.756385088 CET	3778	39272	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:31.756458044 CET	39272	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:31.756489038 CET	39272	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:31.756750107 CET	39274	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:31.763076067 CET	3778	39274	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:31.763123035 CET	39274	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:31.763577938 CET	39274	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:31.769850969 CET	3778	39274	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:31.769898891 CET	39274	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:31.776082993 CET	3778	39274	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:32.434109926 CET	3778	39274	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:32.434298038 CET	39274	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:32.434298038 CET	39274	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:32.434887886 CET	39276	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:32.439748049 CET	3778	39276	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:32.439799070 CET	39276	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:32.440674067 CET	39276	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:32.445461035 CET	3778	39276	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:32.445503950 CET	39276	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:32.450319052 CET	3778	39276	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:33.409492016 CET	3778	39276	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:33.409781933 CET	39276	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:33.409781933 CET	39276	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:33.410125017 CET	39278	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:33.415003061 CET	3778	39278	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:33.415055037 CET	39278	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:33.415807009 CET	39278	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:33.420654058 CET	3778	39278	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:33.420711994 CET	39278	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:33.425457954 CET	3778	39278	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:34.093379974 CET	3778	39278	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:34.093482971 CET	39278	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:34.093499899 CET	39278	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:34.093889952 CET	39280	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:34.100189924 CET	3778	39280	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:34.100236893 CET	39280	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:34.100744963 CET	39280	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:34.106823921 CET	3778	39280	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:34.106864929 CET	39280	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:34.112986088 CET	3778	39280	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:35.972659111 CET	3778	39280	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:35.972759962 CET	39280	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:35.972794056 CET	39280	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:35.973483086 CET	39282	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:35.980065107 CET	3778	39282	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:35.980130911 CET	39282	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:35.981040955 CET	39282	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:35.987952948 CET	3778	39282	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:35.988008022 CET	39282	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:35.994823933 CET	3778	39282	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:36.632221937 CET	3778	39282	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:36.632338047 CET	39282	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:36.632430077 CET	39282	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:36.633027077 CET	39284	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:36.639233112 CET	3778	39284	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:36.639298916 CET	39284	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:36.640167952 CET	39284	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:36.646419048 CET	3778	39284	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:36.646471977 CET	39284	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:36.652532101 CET	3778	39284	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:37.300750971 CET	3778	39284	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:37.300827026 CET	39284	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:37.300906897 CET	39284	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:37.301445007 CET	39286	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:37.307753086 CET	3778	39286	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:37.307815075 CET	39286	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:37.308691025 CET	39286	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:37.315016985 CET	3778	39286	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:37.315072060 CET	39286	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:37.321542025 CET	3778	39286	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:37.968630075 CET	3778	39286	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:37.968710899 CET	39286	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:37.968738079 CET	39286	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:37.969121933 CET	39288	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:37.976068974 CET	3778	39288	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:37.976116896 CET	39288	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:37.976610899 CET	39288	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:37.983211040 CET	3778	39288	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:37.983251095 CET	39288	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:37.990068913 CET	3778	39288	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:38.682917118 CET	3778	39288	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:38.683024883 CET	39288	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:38.683059931 CET	39288	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:38.683461905 CET	39290	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:38.690988064 CET	3778	39290	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:38.691030979 CET	39290	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:38.691514969 CET	39290	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:38.698581934 CET	3778	39290	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:38.698626041 CET	39290	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:38.705419064 CET	3778	39290	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:39.376986980 CET	3778	39290	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:39.377099037 CET	39290	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:39.377152920 CET	39290	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:39.377724886 CET	39292	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:39.384910107 CET	3778	39292	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:39.384965897 CET	39292	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:39.385734081 CET	39292	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:39.392786026 CET	3778	39292	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:39.392854929 CET	39292	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:39.399579048 CET	3778	39292	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:40.163521051 CET	3778	39292	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:40.163580894 CET	39292	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:40.163610935 CET	39292	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:40.163904905 CET	39294	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:40.171694994 CET	3778	39294	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:40.171739101 CET	39294	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:40.172241926 CET	39294	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:40.178985119 CET	3778	39294	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:40.179022074 CET	39294	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:40.186362982 CET	3778	39294	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:40.839673042 CET	3778	39294	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:40.839764118 CET	39294	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:40.839802980 CET	39294	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:40.840168953 CET	39296	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:40.848054886 CET	3778	39296	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:40.848103046 CET	39296	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:40.848571062 CET	39296	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:40.856316090 CET	3778	39296	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:40.856359005 CET	39296	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:40.862576962 CET	3778	39296	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:41.531800032 CET	3778	39296	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:41.531892061 CET	39296	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:41.531938076 CET	39296	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:41.532232046 CET	39298	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:41.539201975 CET	3778	39298	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:41.539247036 CET	39298	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:41.539735079 CET	39298	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:41.546399117 CET	3778	39298	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:41.546443939 CET	39298	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:41.553121090 CET	3778	39298	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:42.200510979 CET	3778	39298	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:42.200598955 CET	39298	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:42.200642109 CET	39298	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:42.200961113 CET	39300	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:42.207602978 CET	3778	39300	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:42.207645893 CET	39300	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:42.208144903 CET	39300	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:42.214806080 CET	3778	39300	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:42.214847088 CET	39300	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:42.221417904 CET	3778	39300	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:42.889211893 CET	3778	39300	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:42.889414072 CET	39300	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:42.889448881 CET	39300	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:42.889805079 CET	39302	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:42.896564007 CET	3778	39302	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:42.896606922 CET	39302	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:42.897114038 CET	39302	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:42.903743982 CET	3778	39302	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:42.903784990 CET	39302	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:42.910419941 CET	3778	39302	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:43.570430040 CET	3778	39302	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:43.570494890 CET	39302	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:43.570518970 CET	39302	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:43.570873022 CET	39304	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:43.577641964 CET	3778	39304	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:43.577687979 CET	39304	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:43.578203917 CET	39304	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:43.585093975 CET	3778	39304	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:43.585134029 CET	39304	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:43.591912985 CET	3778	39304	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:44.231538057 CET	3778	39304	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:44.231614113 CET	39304	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:44.231637001 CET	39304	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:44.231935024 CET	39306	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:44.239085913 CET	3778	39306	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:44.239135981 CET	39306	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:44.239639044 CET	39306	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:44.246256113 CET	3778	39306	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:44.246295929 CET	39306	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:44.252902031 CET	3778	39306	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:54.239341021 CET	39306	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:14:54.245589018 CET	3778	39306	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:54.441620111 CET	3778	39306	45.95.169.120	192.168.2.23
Jan 3, 2025 00:14:54.441682100 CET	39306	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:15:54.477005959 CET	39306	3778	192.168.2.23	45.95.169.120
Jan 3, 2025 00:15:54.481817007 CET	3778	39306	45.95.169.120	192.168.2.23
Jan 3, 2025 00:15:54.678021908 CET	3778	39306	45.95.169.120	192.168.2.23
Jan 3, 2025 00:15:54.678097963 CET	39306	3778	192.168.2.23	45.95.169.120

System Behavior

Analysis Process: wind.spc.elf PID: 6238, Parent PID: 6145

General

Start time (UTC):	23:12:46
Start date (UTC):	02/01/2025
Path:	/tmp/wind.spc.elf
Arguments:	/tmp/wind.spc.elf
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: wind.spc.elf PID: 6240, Parent PID: 6238

General

Start time (UTC):	23:12:46
Start date (UTC):	02/01/2025
Path:	/tmp/wind.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: wind.spc.elf PID: 6241, Parent PID: 6238

General

Start time (UTC):	23:12:46
Start date (UTC):	02/01/2025
Path:	/tmp/wind.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: wind.spc.elf PID: 6242, Parent PID: 6238

General

Start time (UTC):	23:12:46
Start date (UTC):	02/01/2025
Path:	/tmp/wind.spc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: xfce4-panel PID: 6251, Parent PID: 2063

General

Start time (UTC):	23:12:46
Start date (UTC):	02/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6251, Parent PID: 2063

General

Start time (UTC):	23:12:46
Start date (UTC):	02/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 6252, Parent PID: 2063

General

Start time (UTC):	23:12:46
Start date (UTC):	02/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6252, Parent PID: 2063

General

Start time (UTC):	23:12:46
Start date (UTC):	02/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 6253, Parent PID: 2063

General

Start time (UTC):	23:12:46
Start date (UTC):	02/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6253, Parent PID: 2063

General

Start time (UTC):	23:12:46
Start date (UTC):	02/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 6254, Parent PID: 2063

General

Start time (UTC):	23:12:46
Start date (UTC):	02/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6254, Parent PID: 2063

General

Start time (UTC):	23:12:46
Start date (UTC):	02/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 6255, Parent PID: 2063

General

Start time (UTC):	23:12:46
Start date (UTC):	02/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6255, Parent PID: 2063

General

Start time (UTC):	23:12:46
Start date (UTC):	02/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Chronological Activities

Analysis Process: xfce4-panel PID: 6256, Parent PID: 2063

General

Start time (UTC):	23:12:47
Start date (UTC):	02/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6256, Parent PID: 2063

General

Start time (UTC):	23:12:47
Start date (UTC):	02/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report wind.spc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: wind.spc.elf PID: 6238, Parent PID: 6145

General

Chronological Activities

Analysis Process: wind.spc.elf PID: 6240, Parent PID: 6238

General

Chronological Activities

Analysis Process: wind.spc.elf PID: 6241, Parent PID: 6238

General

Chronological Activities

Analysis Process: wind.spc.elf PID: 6242, Parent PID: 6238

General

Chronological Activities

Analysis Process: xfce4-panel PID: 6251, Parent PID: 2063

General

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6251, Parent PID: 2063

General

Chronological Activities

Analysis Process: xfce4-panel PID: 6252, Parent PID: 2063

Linux Analysis Report
wind.spc.elf