Edit tour

Linux Analysis Report
x86_64.elf

Overview

General Information

Sample name:	x86_64.elf
Analysis ID:	1583632
MD5:	33127be57dc9ff0d1ef1f51e613c5517
SHA1:	4fde704f7e241a2d760bad03f3e2fa7b3267f70d
SHA256:	b9cc82bf75b97d7d94783ac1b33da7e842180af893d930812b79c186956707f5
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	84
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Machine Learning detection for sample

Opens /proc/net/* files useful for finding connected devices and routers

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Sample contains only a LOAD segment without any section mappings

Suricata IDS alerts with low severity for network traffic

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583632
Start date and time:	2025-01-03 08:22:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	x86_64.elf
Detection:	MAL
Classification:	mal84.spre.troj.evad.linELF@0/1@2/0

Runtime Messages

Command:	/tmp/x86_64.elf
PID:	5554
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Infected By Simps Botnet ;) Infected By Simps Botnet ;)
Standard Error:

Process Tree

system is lnxubuntu20

x86_64.elf (PID: 5554, Parent: 5473, MD5: 33127be57dc9ff0d1ef1f51e613c5517) Arguments: /tmp/x86_64.elf

x86_64.elf New Fork (PID: 5555, Parent: 5554)

x86_64.elf New Fork (PID: 5556, Parent: 5555)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5554.1.0000000000400000.000000000041a000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5554.1.0000000000400000.000000000041a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5554.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x5a74:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5554.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x10130:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5554.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x599b:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5554.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x108e7:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5554.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_a0a4de11	unknown	unknown	0x6ff1:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88
5554.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xd1fa:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xd35c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5554.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0x61a2:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x6255:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x648b:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
5554.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_46eec778	unknown	unknown	0x27c:$a: C0 01 45 F8 48 83 45 E8 02 83 6D C8 02 83 7D C8 01 7F E4 83 7D 0x67d9:$a: C0 01 45 F8 48 83 45 E8 02 83 6D C8 02 83 7D C8 01 7F E4 83 7D
5554.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x1324e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5554.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x14b52:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
5554.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x104a7:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5554.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x68f1:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
5554.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x58c3:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5554.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x5403:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
5554.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xf672:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5554.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x10772:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5554.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_e4a1982b	unknown	unknown	0x53f7:$a: 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89
5554.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_862c4e0e	unknown	unknown	0x2f7:$a: 02 89 45 F8 8B 45 F8 C1 E8 10 85 C0 75 E6 8B 45 F8 F7 D0 0F 0x6854:$a: 02 89 45 F8 8B 45 F8 C1 E8 10 85 C0 75 E6 8B 45 F8 F7 D0 0F
5554.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_32eb0c81	unknown	unknown	0x5910:$a: D4 48 FF 45 F0 48 8B 45 F0 0F B6 00 84 C0 75 DB EB 12 48 8B
5555.1.0000000000400000.000000000041a000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5555.1.0000000000400000.000000000041a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5554.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xf86b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5554.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Mirai_3fe3c668	unknown	unknown	0xca0e:$a: 00 84 C0 0F 95 C0 48 FF 45 E8 84 C0 75 E9 8B 45 FC C9 C3 55 48
5554.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Mirai_637f2c04	unknown	unknown	0xca6b:$a: 10 48 8B 45 E0 0F B6 00 38 C2 0F 95 C0 48 FF 45 E8 48 FF 45 E0 0xcae1:$a: 10 48 8B 45 E0 0F B6 00 38 C2 0F 95 C0 48 FF 45 E8 48 FF 45 E0
5555.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x5a74:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5555.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x10130:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5555.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x599b:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5555.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x108e7:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5555.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_a0a4de11	unknown	unknown	0x6ff1:$a: 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88
5555.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xd1fa:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xd35c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5555.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_09c3070e	unknown	unknown	0x61a2:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x6255:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 0x648b:$a: 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83
5555.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_46eec778	unknown	unknown	0x27c:$a: C0 01 45 F8 48 83 45 E8 02 83 6D C8 02 83 7D C8 01 7F E4 83 7D 0x67d9:$a: C0 01 45 F8 48 83 45 E8 02 83 6D C8 02 83 7D C8 01 7F E4 83 7D
5555.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x1324e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5555.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x14b52:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
5555.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x104a7:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5555.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_dd0d6173	unknown	unknown	0x68f1:$a: 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48
5555.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x58c3:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5555.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_cf84c9f2	unknown	unknown	0x5403:$a: 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00
5555.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xf672:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5555.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x10772:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5555.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_e4a1982b	unknown	unknown	0x53f7:$a: 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89
5555.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_862c4e0e	unknown	unknown	0x2f7:$a: 02 89 45 F8 8B 45 F8 C1 E8 10 85 C0 75 E6 8B 45 F8 F7 D0 0F 0x6854:$a: 02 89 45 F8 8B 45 F8 C1 E8 10 85 C0 75 E6 8B 45 F8 F7 D0 0F
5555.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_32eb0c81	unknown	unknown	0x5910:$a: D4 48 FF 45 F0 48 8B 45 F0 0F B6 00 84 C0 75 DB EB 12 48 8B
5555.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xf86b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5555.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Mirai_3fe3c668	unknown	unknown	0xca0e:$a: 00 84 C0 0F 95 C0 48 FF 45 E8 84 C0 75 E9 8B 45 FC C9 C3 55 48
5555.1.0000000000400000.000000000041a000.r-x.sdmp	Linux_Trojan_Mirai_637f2c04	unknown	unknown	0xca6b:$a: 10 48 8B 45 E0 0F B6 00 38 C2 0F 95 C0 48 FF 45 E8 48 FF 45 E0 0xcae1:$a: 10 48 8B 45 E0 0F B6 00 38 C2 0F 95 C0 48 FF 45 E8 48 FF 45 E0
Process Memory Space: x86_64.elf PID: 5554	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: x86_64.elf PID: 5555	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Click to see the 45 entries

Suricata Signatures

ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T08:23:16.603258+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46592	212.64.199.97	65525	TCP
2025-01-03T08:23:18.385772+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46594	212.64.199.97	65525	TCP
2025-01-03T08:23:20.169501+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46596	212.64.199.97	65525	TCP
2025-01-03T08:23:21.951872+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46598	212.64.199.97	65525	TCP
2025-01-03T08:23:23.779535+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46600	212.64.199.97	65525	TCP
2025-01-03T08:23:25.564334+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46602	212.64.199.97	65525	TCP
2025-01-03T08:23:27.339598+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46604	212.64.199.97	65525	TCP
2025-01-03T08:23:29.118887+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46606	212.64.199.97	65525	TCP
2025-01-03T08:23:30.901273+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46608	212.64.199.97	65525	TCP
2025-01-03T08:23:32.683895+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46610	212.64.199.97	65525	TCP
2025-01-03T08:23:34.461508+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46612	212.64.199.97	65525	TCP
2025-01-03T08:23:36.243534+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46614	212.64.199.97	65525	TCP
2025-01-03T08:23:38.024344+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46616	212.64.199.97	65525	TCP
2025-01-03T08:23:39.805240+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46618	212.64.199.97	65525	TCP
2025-01-03T08:23:41.598709+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46620	212.64.199.97	65525	TCP
2025-01-03T08:23:43.388970+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46622	212.64.199.97	65525	TCP
2025-01-03T08:23:45.177750+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46624	212.64.199.97	65525	TCP
2025-01-03T08:23:46.982562+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46626	212.64.199.97	65525	TCP
2025-01-03T08:23:48.778255+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46628	212.64.199.97	65525	TCP
2025-01-03T08:23:50.551470+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46630	212.64.199.97	65525	TCP
2025-01-03T08:23:52.342224+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46632	212.64.199.97	65525	TCP
2025-01-03T08:23:54.137255+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46634	212.64.199.97	65525	TCP
2025-01-03T08:23:55.895652+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46636	212.64.199.97	65525	TCP
2025-01-03T08:23:57.678747+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46638	212.64.199.97	65525	TCP
2025-01-03T08:23:59.469922+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46640	212.64.199.97	65525	TCP
2025-01-03T08:24:01.246116+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46642	212.64.199.97	65525	TCP
2025-01-03T08:24:03.028935+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46644	212.64.199.97	65525	TCP
2025-01-03T08:24:04.815937+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46646	212.64.199.97	65525	TCP
2025-01-03T08:24:06.603855+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46648	212.64.199.97	65525	TCP
2025-01-03T08:24:08.518435+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46650	212.64.199.97	65525	TCP
2025-01-03T08:24:10.305833+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46652	212.64.199.97	65525	TCP
2025-01-03T08:24:12.087787+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46654	212.64.199.97	65525	TCP
2025-01-03T08:24:13.874468+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46656	212.64.199.97	65525	TCP
2025-01-03T08:24:15.646298+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46658	212.64.199.97	65525	TCP
2025-01-03T08:24:17.442464+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46660	212.64.199.97	65525	TCP
2025-01-03T08:24:19.214450+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46662	212.64.199.97	65525	TCP
2025-01-03T08:24:21.017030+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46664	212.64.199.97	65525	TCP
2025-01-03T08:24:22.820281+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46666	212.64.199.97	65525	TCP
2025-01-03T08:24:24.584566+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46668	212.64.199.97	65525	TCP
2025-01-03T08:24:26.369535+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46670	212.64.199.97	65525	TCP
2025-01-03T08:24:28.152564+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46672	212.64.199.97	65525	TCP
2025-01-03T08:24:29.932469+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46674	212.64.199.97	65525	TCP
2025-01-03T08:24:31.715246+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46676	212.64.199.97	65525	TCP
2025-01-03T08:24:33.517601+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46678	212.64.199.97	65525	TCP
2025-01-03T08:24:35.328223+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46680	212.64.199.97	65525	TCP
2025-01-03T08:24:37.281438+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46682	212.64.199.97	65525	TCP
2025-01-03T08:24:39.078248+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46684	212.64.199.97	65525	TCP
2025-01-03T08:24:40.875309+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46686	212.64.199.97	65525	TCP
2025-01-03T08:24:42.646489+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46688	212.64.199.97	65525	TCP
2025-01-03T08:24:44.427899+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46690	212.64.199.97	65525	TCP
2025-01-03T08:24:46.219864+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46692	212.64.199.97	65525	TCP
2025-01-03T08:24:47.993722+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46694	212.64.199.97	65525	TCP
2025-01-03T08:24:49.756368+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46696	212.64.199.97	65525	TCP
2025-01-03T08:24:51.522571+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46698	212.64.199.97	65525	TCP
2025-01-03T08:24:53.293682+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46700	212.64.199.97	65525	TCP
2025-01-03T08:24:55.096292+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46702	212.64.199.97	65525	TCP
2025-01-03T08:24:56.891704+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46704	212.64.199.97	65525	TCP
2025-01-03T08:24:58.688398+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46706	212.64.199.97	65525	TCP
2025-01-03T08:25:00.477227+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46708	212.64.199.97	65525	TCP
2025-01-03T08:25:02.251513+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46710	212.64.199.97	65525	TCP
2025-01-03T08:25:04.046753+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46712	212.64.199.97	65525	TCP
2025-01-03T08:25:05.864263+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46714	212.64.199.97	65525	TCP
2025-01-03T08:25:07.631706+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46716	212.64.199.97	65525	TCP
2025-01-03T08:25:09.399731+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46718	212.64.199.97	65525	TCP
2025-01-03T08:25:11.190053+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46720	212.64.199.97	65525	TCP
2025-01-03T08:25:12.975661+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46722	212.64.199.97	65525	TCP
2025-01-03T08:25:14.762788+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46724	212.64.199.97	65525	TCP
2025-01-03T08:25:16.543052+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46726	212.64.199.97	65525	TCP
2025-01-03T08:25:18.329144+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46728	212.64.199.97	65525	TCP
2025-01-03T08:25:20.108292+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46730	212.64.199.97	65525	TCP
2025-01-03T08:25:21.913256+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46732	212.64.199.97	65525	TCP
2025-01-03T08:25:23.685467+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46734	212.64.199.97	65525	TCP
2025-01-03T08:25:25.466384+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46736	212.64.199.97	65525	TCP
2025-01-03T08:25:27.248410+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46738	212.64.199.97	65525	TCP
2025-01-03T08:25:29.024145+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46740	212.64.199.97	65525	TCP
2025-01-03T08:25:30.811853+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46742	212.64.199.97	65525	TCP
2025-01-03T08:25:32.603665+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46744	212.64.199.97	65525	TCP
2025-01-03T08:25:34.388808+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46746	212.64.199.97	65525	TCP
2025-01-03T08:25:36.188889+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46748	212.64.199.97	65525	TCP
2025-01-03T08:25:37.987892+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46750	212.64.199.97	65525	TCP
2025-01-03T08:25:39.784449+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46752	212.64.199.97	65525	TCP
2025-01-03T08:25:41.560243+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46754	212.64.199.97	65525	TCP
2025-01-03T08:25:43.363080+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46756	212.64.199.97	65525	TCP
2025-01-03T08:25:45.173405+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46758	212.64.199.97	65525	TCP
2025-01-03T08:25:46.950587+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46760	212.64.199.97	65525	TCP
2025-01-03T08:25:48.732421+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46762	212.64.199.97	65525	TCP
2025-01-03T08:25:50.515586+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46764	212.64.199.97	65525	TCP
2025-01-03T08:25:52.289734+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46766	212.64.199.97	65525	TCP
2025-01-03T08:25:54.059711+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46768	212.64.199.97	65525	TCP
2025-01-03T08:25:55.848719+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46770	212.64.199.97	65525	TCP
2025-01-03T08:25:57.648952+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46772	212.64.199.97	65525	TCP
2025-01-03T08:25:59.447916+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46774	212.64.199.97	65525	TCP
2025-01-03T08:26:01.232670+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46776	212.64.199.97	65525	TCP
2025-01-03T08:26:03.012154+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46780	212.64.199.97	65525	TCP
2025-01-03T08:26:04.774364+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46782	212.64.199.97	65525	TCP
2025-01-03T08:26:06.579675+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46784	212.64.199.97	65525	TCP
2025-01-03T08:26:08.390371+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46786	212.64.199.97	65525	TCP
2025-01-03T08:26:10.166282+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46788	212.64.199.97	65525	TCP
2025-01-03T08:26:11.949195+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46790	212.64.199.97	65525	TCP
2025-01-03T08:26:13.731623+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46792	212.64.199.97	65525	TCP
2025-01-03T08:26:15.515898+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46794	212.64.199.97	65525	TCP
2025-01-03T08:26:17.317652+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46796	212.64.199.97	65525	TCP
2025-01-03T08:26:19.102184+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46798	212.64.199.97	65525	TCP
2025-01-03T08:26:20.893203+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46800	212.64.199.97	65525	TCP
2025-01-03T08:26:22.664761+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46802	212.64.199.97	65525	TCP
2025-01-03T08:26:24.463266+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46804	212.64.199.97	65525	TCP
2025-01-03T08:26:26.248664+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46806	212.64.199.97	65525	TCP
2025-01-03T08:26:28.029463+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46808	212.64.199.97	65525	TCP
2025-01-03T08:26:29.832636+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46810	212.64.199.97	65525	TCP
2025-01-03T08:26:31.631594+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46812	212.64.199.97	65525	TCP
2025-01-03T08:26:33.427028+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46814	212.64.199.97	65525	TCP
2025-01-03T08:26:35.197935+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46816	212.64.199.97	65525	TCP
2025-01-03T08:26:36.987178+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46818	212.64.199.97	65525	TCP
2025-01-03T08:26:38.787443+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46820	212.64.199.97	65525	TCP
2025-01-03T08:26:40.581230+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46822	212.64.199.97	65525	TCP
2025-01-03T08:26:42.381065+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46824	212.64.199.97	65525	TCP
2025-01-03T08:26:44.154857+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46826	212.64.199.97	65525	TCP
2025-01-03T08:26:45.935784+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46828	212.64.199.97	65525	TCP
2025-01-03T08:26:47.699675+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46830	212.64.199.97	65525	TCP
2025-01-03T08:26:49.491163+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46832	212.64.199.97	65525	TCP
2025-01-03T08:26:51.259509+0100	2848448	1	A Network Trojan was detected	192.168.2.14	46834	212.64.199.97	65525	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: x86_64.elf	ReversingLabs: Detection: 39%
Source: x86_64.elf	Virustotal: Detection: 39%			Perma Link

Machine Learning detection for sample

Source: x86_64.elf

Joe Sandbox ML: detected

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/x86_64.elf (PID: 5554)

Opens: /proc/net/route

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.14:46592 -> 212.64.199.97:65525

Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46594 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46606 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46608 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46598 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46628 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46630 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46622 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46706 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46658 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46610 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46656 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46716 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46672 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46704 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46714 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46600 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46616 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46652 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46604 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46626 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46700 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46618 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46708 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46680 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46724 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46738 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46650 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46750 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46702 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46760 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46614 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46772 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46636 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46592 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46768 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46696 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46694 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46832 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46624 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46640 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46620 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46682 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46710 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46726 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46642 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46648 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46720 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46692 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46814 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46784 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46812 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46668 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46638 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46646 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46808 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46670 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46674 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46662 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46678 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46602 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46686 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46612 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46654 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46756 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46742 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46820 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46664 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46762 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46830 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46684 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46780 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46740 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46810 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46690 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46796 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46676 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46736 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46794 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46632 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46758 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46818 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46770 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46634 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46786 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46718 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46806 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46644 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46828 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46782 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46798 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46834 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46826 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46788 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46744 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46596 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46748 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46732 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46790 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46734 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46816 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46752 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46822 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46730 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46746 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46766 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46792 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46754 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46698 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46776 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46722 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46712 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46824 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46660 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46688 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46804 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46764 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46666 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46800 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46774 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46802 -> 212.64.199.97:65525
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.14:46728 -> 212.64.199.97:65525

Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97
Source: unknown	TCP traffic detected without corresponding DNS query: 212.64.199.97

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: x86_64.elf, 5555.1.0000000000400000.000000000041a000.r-x.sdmp	String found in binary or memory: http://212.64.199.97/Simps/mips
Source: x86_64.elf, 5554.1.0000000000400000.000000000041a000.r-x.sdmp, x86_64.elf, 5555.1.0000000000400000.000000000041a000.r-x.sdmp	String found in binary or memory: http://purenetworks.com/HNAP1/
Source: x86_64.elf, 5555.1.0000000000400000.000000000041a000.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: x86_64.elf, 5555.1.0000000000400000.000000000041a000.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: x86_64.elf	String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 Author: unknown
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_46eec778 Author: unknown
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b Author: unknown
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_862c4e0e Author: unknown
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_32eb0c81 Author: unknown
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3fe3c668 Author: unknown
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_637f2c04 Author: unknown
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 Author: unknown
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e Author: unknown
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_46eec778 Author: unknown
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 Author: unknown
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 Author: unknown
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b Author: unknown
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_862c4e0e Author: unknown
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_32eb0c81 Author: unknown
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3fe3c668 Author: unknown
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_637f2c04 Author: unknown

Source: LOAD without section mappings

Program segment: 0x100000

Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047, id = a0a4de11-fe65-449f-a990-ad5f18ac66f0, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_46eec778 reference_sample = 9526277255a8d632355bfe54d53154c9c54a4ab75e3ba24333c73ad0ed7cadb1, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 2602371a40171870b1cf024f262e95a2853de53de39c3a6cd3de811e81dd3518, id = 46eec778-7342-4ef7-adac-35bc0cdb9867, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622, id = e4a1982b-928a-4da5-b497-cedc1d26e845, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_862c4e0e reference_sample = 9526277255a8d632355bfe54d53154c9c54a4ab75e3ba24333c73ad0ed7cadb1, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 2a6b4f8d8fb4703ed26bdcfbbb5c539dc451c8b90649bee80015c164eae4c281, id = 862c4e0e-83a4-458b-8c00-f2f3cf0bf9db, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_32eb0c81 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 7c50ed29e2dd75a6a85afc43f8452794cb787ecd2061f4bf415d7038c14c523f, id = 32eb0c81-25af-4670-ab77-07ea7ce1874a, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3fe3c668 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 2a79caea707eb0ecd740106ea4bed2918e7592c1e5ad6050f6f0992cf31ba5ec, id = 3fe3c668-89f4-4601-a167-f41bbd984ae5, last_modified = 2021-09-16
Source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_637f2c04 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 7af3d573af8b7f8252590a53adda52ecf53bdaf9a86b52ef50702f048e08ba8c, id = 637f2c04-98e4-45aa-b60a-14a96c6cebb7, last_modified = 2021-09-16
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a0a4de11 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047, id = a0a4de11-fe65-449f-a990-ad5f18ac66f0, last_modified = 2021-09-16
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_09c3070e reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d, id = 09c3070e-4b71-45a0-aa62-0cc6e496644a, last_modified = 2021-09-16
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_46eec778 reference_sample = 9526277255a8d632355bfe54d53154c9c54a4ab75e3ba24333c73ad0ed7cadb1, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 2602371a40171870b1cf024f262e95a2853de53de39c3a6cd3de811e81dd3518, id = 46eec778-7342-4ef7-adac-35bc0cdb9867, last_modified = 2021-09-16
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_dd0d6173 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f, id = dd0d6173-b863-45cf-9348-3375a4e624cf, last_modified = 2021-09-16
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_cf84c9f2 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc, id = cf84c9f2-7435-4faf-8c5f-d14945ffad7a, last_modified = 2021-09-16
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e4a1982b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622, id = e4a1982b-928a-4da5-b497-cedc1d26e845, last_modified = 2021-09-16
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_862c4e0e reference_sample = 9526277255a8d632355bfe54d53154c9c54a4ab75e3ba24333c73ad0ed7cadb1, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 2a6b4f8d8fb4703ed26bdcfbbb5c539dc451c8b90649bee80015c164eae4c281, id = 862c4e0e-83a4-458b-8c00-f2f3cf0bf9db, last_modified = 2021-09-16
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_32eb0c81 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 7c50ed29e2dd75a6a85afc43f8452794cb787ecd2061f4bf415d7038c14c523f, id = 32eb0c81-25af-4670-ab77-07ea7ce1874a, last_modified = 2021-09-16
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3fe3c668 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 2a79caea707eb0ecd740106ea4bed2918e7592c1e5ad6050f6f0992cf31ba5ec, id = 3fe3c668-89f4-4601-a167-f41bbd984ae5, last_modified = 2021-09-16
Source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_637f2c04 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 7af3d573af8b7f8252590a53adda52ecf53bdaf9a86b52ef50702f048e08ba8c, id = 637f2c04-98e4-45aa-b60a-14a96c6cebb7, last_modified = 2021-09-16

Source: classification engine

Classification label: mal84.spre.troj.evad.linELF@0/1@2/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/x86_64.elf (PID: 5554)

Log file created: /tmp/Infected.log

Jump to dropped file

Source: x86_64.elf

Submission file: segment LOAD with 7.9691 entropy (max. 8.0)

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: x86_64.elf PID: 5554, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: x86_64.elf PID: 5555, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 5554.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5555.1.0000000000400000.000000000041a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: x86_64.elf PID: 5554, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: x86_64.elf PID: 5555, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	OS Credential Dumping	1 Remote System Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
x86_64.elf	39%	ReversingLabs	Linux.Backdoor.Gafgyt
x86_64.elf	40%	Virustotal		Browse
x86_64.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://upx.sf.net	x86_64.elf	false	high
http://212.64.199.97/Simps/mips	x86_64.elf, 5555.1.0000000000400000.000000000041a000.r-x.sdmp	false	high
http://schemas.xmlsoap.org/soap/encoding/	x86_64.elf, 5555.1.0000000000400000.000000000041a000.r-x.sdmp	false	high
http://purenetworks.com/HNAP1/	x86_64.elf, 5554.1.0000000000400000.000000000041a000.r-x.sdmp, x86_64.elf, 5555.1.0000000000400000.000000000041a000.r-x.sdmp	false	high
http://schemas.xmlsoap.org/soap/envelope/	x86_64.elf, 5555.1.0000000000400000.000000000041a000.r-x.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
212.64.199.97	unknown	Turkey		12599	ATLAS-ASTR	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
212.64.199.97	armv7l.elf	Get hash	malicious	Mirai	Browse
	i586.elf	Get hash	malicious	Mirai	Browse
	m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	mips.elf	Get hash	malicious	Mirai	Browse
	armv6l.elf	Get hash	malicious	Mirai	Browse
	sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	armv4l.elf	Get hash	malicious	Mirai	Browse
	mipsel.elf	Get hash	malicious	Mirai	Browse
	sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	powerpc.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	armv7l.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	i586.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	2.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	armv6l.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	armv4l.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	mipsel.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	i686.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATLAS-ASTR	armv7l.elf	Get hash	malicious	Mirai	Browse	212.64.199.97
	i586.elf	Get hash	malicious	Mirai	Browse	212.64.199.97
	m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	212.64.199.97
	mips.elf	Get hash	malicious	Mirai	Browse	212.64.199.97
	armv6l.elf	Get hash	malicious	Mirai	Browse	212.64.199.97
	sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	212.64.199.97
	armv4l.elf	Get hash	malicious	Mirai	Browse	212.64.199.97
	mipsel.elf	Get hash	malicious	Mirai	Browse	212.64.199.97
	sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	212.64.199.97
	powerpc.elf	Get hash	malicious	Mirai	Browse	212.64.199.97

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/Infected.log

Download File

Process:	/tmp/x86_64.elf
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	149
Entropy (8bit):	5.041576920829991
Encrypted:	false
SSDEEP:	3:xRbQRAZvbFhSZWFBAK8dAuFUJ4gnicMMIVDt8TovZ2XCRA5Adcovn:xR0qvbFhSZW8K8djmHicNoDt8kBSKBcy
MD5:	68CEF17158AB7C78815F4829CA182DF0
SHA1:	1964BD86E351AE38341975A5A35C2A606093220E
SHA-256:	8CB5D165724D5990B6C6161D24AD22E55328C2CF72E46B58104EFE0CC07E82E3
SHA-512:	C39117FAEEB6103E531FDBDD517BB259A1E21E2C0F67B203D8AA8787F5D11F3CC090BCE9E951146C7CB163E1F36F15C3AEAF82CCE953DF715CD59BE7846206FA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	Thank You For Your Services...This Device Has successfully Been Infected..With Malware By Simps Botnet ;)..\| instagram: @ur0a_ \| Discord: UR0A#2199..

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, no section header
Entropy (8bit):	7.9850230728088025
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	x86_64.elf
File size:	67'604 bytes
MD5:	33127be57dc9ff0d1ef1f51e613c5517
SHA1:	4fde704f7e241a2d760bad03f3e2fa7b3267f70d
SHA256:	b9cc82bf75b97d7d94783ac1b33da7e842180af893d930812b79c186956707f5
SHA512:	0f864972b44b689bfe4a4da70b5e94ea281f2acd43b26227bf68b13c4075422092454ebb4254fd66d3650362aad978ec271187c6cffeb74ff94a3e5ef091c348
SSDEEP:	1536:U4daOzVBlHqt5C0PlqOmux0X8Jwu9Cd1Yhm701p4IRtbaB75FcyWjE2i6o:NgOzl+5C0qLX8L9Cd1qp4JcNjIB
TLSH:	6063F196017FE7F2C46326BB109ACDD6FAF65C03C640927F40D6A86E6EFA1431260F12
File Content Preview:	.ELF..............>.............@...................@.8...@.....................................T.......T.................................R.......R.............................Q.td....................................................SGm.UPX!H........"...".

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x109418
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	64
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x100000	0x100000	0xa554	0xa554	7.9691	0x5	R E	0x100000
LOAD	0x8f0	0x5208f0	0x5208f0	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-03T08:23:16.603258+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46592	212.64.199.97	65525	TCP
2025-01-03T08:23:18.385772+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46594	212.64.199.97	65525	TCP
2025-01-03T08:23:20.169501+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46596	212.64.199.97	65525	TCP
2025-01-03T08:23:21.951872+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46598	212.64.199.97	65525	TCP
2025-01-03T08:23:23.779535+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46600	212.64.199.97	65525	TCP
2025-01-03T08:23:25.564334+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46602	212.64.199.97	65525	TCP
2025-01-03T08:23:27.339598+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46604	212.64.199.97	65525	TCP
2025-01-03T08:23:29.118887+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46606	212.64.199.97	65525	TCP
2025-01-03T08:23:30.901273+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46608	212.64.199.97	65525	TCP
2025-01-03T08:23:32.683895+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46610	212.64.199.97	65525	TCP
2025-01-03T08:23:34.461508+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46612	212.64.199.97	65525	TCP
2025-01-03T08:23:36.243534+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46614	212.64.199.97	65525	TCP
2025-01-03T08:23:38.024344+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46616	212.64.199.97	65525	TCP
2025-01-03T08:23:39.805240+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46618	212.64.199.97	65525	TCP
2025-01-03T08:23:41.598709+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46620	212.64.199.97	65525	TCP
2025-01-03T08:23:43.388970+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46622	212.64.199.97	65525	TCP
2025-01-03T08:23:45.177750+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46624	212.64.199.97	65525	TCP
2025-01-03T08:23:46.982562+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46626	212.64.199.97	65525	TCP
2025-01-03T08:23:48.778255+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46628	212.64.199.97	65525	TCP
2025-01-03T08:23:50.551470+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46630	212.64.199.97	65525	TCP
2025-01-03T08:23:52.342224+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46632	212.64.199.97	65525	TCP
2025-01-03T08:23:54.137255+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46634	212.64.199.97	65525	TCP
2025-01-03T08:23:55.895652+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46636	212.64.199.97	65525	TCP
2025-01-03T08:23:57.678747+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46638	212.64.199.97	65525	TCP
2025-01-03T08:23:59.469922+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46640	212.64.199.97	65525	TCP
2025-01-03T08:24:01.246116+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46642	212.64.199.97	65525	TCP
2025-01-03T08:24:03.028935+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46644	212.64.199.97	65525	TCP
2025-01-03T08:24:04.815937+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46646	212.64.199.97	65525	TCP
2025-01-03T08:24:06.603855+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46648	212.64.199.97	65525	TCP
2025-01-03T08:24:08.518435+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46650	212.64.199.97	65525	TCP
2025-01-03T08:24:10.305833+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46652	212.64.199.97	65525	TCP
2025-01-03T08:24:12.087787+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46654	212.64.199.97	65525	TCP
2025-01-03T08:24:13.874468+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46656	212.64.199.97	65525	TCP
2025-01-03T08:24:15.646298+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46658	212.64.199.97	65525	TCP
2025-01-03T08:24:17.442464+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46660	212.64.199.97	65525	TCP
2025-01-03T08:24:19.214450+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46662	212.64.199.97	65525	TCP
2025-01-03T08:24:21.017030+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46664	212.64.199.97	65525	TCP
2025-01-03T08:24:22.820281+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46666	212.64.199.97	65525	TCP
2025-01-03T08:24:24.584566+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46668	212.64.199.97	65525	TCP
2025-01-03T08:24:26.369535+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46670	212.64.199.97	65525	TCP
2025-01-03T08:24:28.152564+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46672	212.64.199.97	65525	TCP
2025-01-03T08:24:29.932469+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46674	212.64.199.97	65525	TCP
2025-01-03T08:24:31.715246+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46676	212.64.199.97	65525	TCP
2025-01-03T08:24:33.517601+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46678	212.64.199.97	65525	TCP
2025-01-03T08:24:35.328223+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46680	212.64.199.97	65525	TCP
2025-01-03T08:24:37.281438+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46682	212.64.199.97	65525	TCP
2025-01-03T08:24:39.078248+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46684	212.64.199.97	65525	TCP
2025-01-03T08:24:40.875309+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46686	212.64.199.97	65525	TCP
2025-01-03T08:24:42.646489+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46688	212.64.199.97	65525	TCP
2025-01-03T08:24:44.427899+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46690	212.64.199.97	65525	TCP
2025-01-03T08:24:46.219864+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46692	212.64.199.97	65525	TCP
2025-01-03T08:24:47.993722+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46694	212.64.199.97	65525	TCP
2025-01-03T08:24:49.756368+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46696	212.64.199.97	65525	TCP
2025-01-03T08:24:51.522571+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46698	212.64.199.97	65525	TCP
2025-01-03T08:24:53.293682+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46700	212.64.199.97	65525	TCP
2025-01-03T08:24:55.096292+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46702	212.64.199.97	65525	TCP
2025-01-03T08:24:56.891704+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46704	212.64.199.97	65525	TCP
2025-01-03T08:24:58.688398+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46706	212.64.199.97	65525	TCP
2025-01-03T08:25:00.477227+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46708	212.64.199.97	65525	TCP
2025-01-03T08:25:02.251513+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46710	212.64.199.97	65525	TCP
2025-01-03T08:25:04.046753+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46712	212.64.199.97	65525	TCP
2025-01-03T08:25:05.864263+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46714	212.64.199.97	65525	TCP
2025-01-03T08:25:07.631706+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46716	212.64.199.97	65525	TCP
2025-01-03T08:25:09.399731+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46718	212.64.199.97	65525	TCP
2025-01-03T08:25:11.190053+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46720	212.64.199.97	65525	TCP
2025-01-03T08:25:12.975661+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46722	212.64.199.97	65525	TCP
2025-01-03T08:25:14.762788+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46724	212.64.199.97	65525	TCP
2025-01-03T08:25:16.543052+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46726	212.64.199.97	65525	TCP
2025-01-03T08:25:18.329144+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46728	212.64.199.97	65525	TCP
2025-01-03T08:25:20.108292+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46730	212.64.199.97	65525	TCP
2025-01-03T08:25:21.913256+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46732	212.64.199.97	65525	TCP
2025-01-03T08:25:23.685467+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46734	212.64.199.97	65525	TCP
2025-01-03T08:25:25.466384+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46736	212.64.199.97	65525	TCP
2025-01-03T08:25:27.248410+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46738	212.64.199.97	65525	TCP
2025-01-03T08:25:29.024145+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46740	212.64.199.97	65525	TCP
2025-01-03T08:25:30.811853+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46742	212.64.199.97	65525	TCP
2025-01-03T08:25:32.603665+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46744	212.64.199.97	65525	TCP
2025-01-03T08:25:34.388808+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46746	212.64.199.97	65525	TCP
2025-01-03T08:25:36.188889+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46748	212.64.199.97	65525	TCP
2025-01-03T08:25:37.987892+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46750	212.64.199.97	65525	TCP
2025-01-03T08:25:39.784449+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46752	212.64.199.97	65525	TCP
2025-01-03T08:25:41.560243+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46754	212.64.199.97	65525	TCP
2025-01-03T08:25:43.363080+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46756	212.64.199.97	65525	TCP
2025-01-03T08:25:45.173405+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46758	212.64.199.97	65525	TCP
2025-01-03T08:25:46.950587+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46760	212.64.199.97	65525	TCP
2025-01-03T08:25:48.732421+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46762	212.64.199.97	65525	TCP
2025-01-03T08:25:50.515586+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46764	212.64.199.97	65525	TCP
2025-01-03T08:25:52.289734+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46766	212.64.199.97	65525	TCP
2025-01-03T08:25:54.059711+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46768	212.64.199.97	65525	TCP
2025-01-03T08:25:55.848719+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46770	212.64.199.97	65525	TCP
2025-01-03T08:25:57.648952+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46772	212.64.199.97	65525	TCP
2025-01-03T08:25:59.447916+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46774	212.64.199.97	65525	TCP
2025-01-03T08:26:01.232670+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46776	212.64.199.97	65525	TCP
2025-01-03T08:26:03.012154+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46780	212.64.199.97	65525	TCP
2025-01-03T08:26:04.774364+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46782	212.64.199.97	65525	TCP
2025-01-03T08:26:06.579675+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46784	212.64.199.97	65525	TCP
2025-01-03T08:26:08.390371+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46786	212.64.199.97	65525	TCP
2025-01-03T08:26:10.166282+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46788	212.64.199.97	65525	TCP
2025-01-03T08:26:11.949195+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46790	212.64.199.97	65525	TCP
2025-01-03T08:26:13.731623+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46792	212.64.199.97	65525	TCP
2025-01-03T08:26:15.515898+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46794	212.64.199.97	65525	TCP
2025-01-03T08:26:17.317652+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46796	212.64.199.97	65525	TCP
2025-01-03T08:26:19.102184+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46798	212.64.199.97	65525	TCP
2025-01-03T08:26:20.893203+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46800	212.64.199.97	65525	TCP
2025-01-03T08:26:22.664761+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46802	212.64.199.97	65525	TCP
2025-01-03T08:26:24.463266+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46804	212.64.199.97	65525	TCP
2025-01-03T08:26:26.248664+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46806	212.64.199.97	65525	TCP
2025-01-03T08:26:28.029463+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46808	212.64.199.97	65525	TCP
2025-01-03T08:26:29.832636+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46810	212.64.199.97	65525	TCP
2025-01-03T08:26:31.631594+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46812	212.64.199.97	65525	TCP
2025-01-03T08:26:33.427028+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46814	212.64.199.97	65525	TCP
2025-01-03T08:26:35.197935+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46816	212.64.199.97	65525	TCP
2025-01-03T08:26:36.987178+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46818	212.64.199.97	65525	TCP
2025-01-03T08:26:38.787443+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46820	212.64.199.97	65525	TCP
2025-01-03T08:26:40.581230+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46822	212.64.199.97	65525	TCP
2025-01-03T08:26:42.381065+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46824	212.64.199.97	65525	TCP
2025-01-03T08:26:44.154857+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46826	212.64.199.97	65525	TCP
2025-01-03T08:26:45.935784+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46828	212.64.199.97	65525	TCP
2025-01-03T08:26:47.699675+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46830	212.64.199.97	65525	TCP
2025-01-03T08:26:49.491163+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46832	212.64.199.97	65525	TCP
2025-01-03T08:26:51.259509+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.14	46834	212.64.199.97	65525	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 08:23:16.598170042 CET	46592	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:16.603104115 CET	65525	46592	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:16.603193998 CET	46592	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:16.603257895 CET	46592	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:16.608087063 CET	65525	46592	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:18.380031109 CET	65525	46592	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:18.380424023 CET	46592	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:18.380898952 CET	46594	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:18.385250092 CET	65525	46592	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:18.385690928 CET	65525	46594	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:18.385752916 CET	46594	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:18.385771990 CET	46594	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:18.390542030 CET	65525	46594	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:20.163875103 CET	65525	46594	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:20.164213896 CET	46594	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:20.164654016 CET	46596	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:20.168983936 CET	65525	46594	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:20.169434071 CET	65525	46596	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:20.169487000 CET	46596	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:20.169501066 CET	46596	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:20.174304008 CET	65525	46596	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:21.943911076 CET	65525	46596	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:21.944293976 CET	46596	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:21.944832087 CET	46598	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:21.951214075 CET	65525	46596	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:21.951814890 CET	65525	46598	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:21.951858997 CET	46598	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:21.951872110 CET	46598	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:21.956664085 CET	65525	46598	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:23.773901939 CET	65525	46598	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:23.774127960 CET	46598	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:23.774625063 CET	46600	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:23.778877974 CET	65525	46598	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:23.779468060 CET	65525	46600	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:23.779522896 CET	46600	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:23.779535055 CET	46600	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:23.784346104 CET	65525	46600	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:25.558821917 CET	65525	46600	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:25.559066057 CET	46600	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:25.559484959 CET	46602	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:25.563862085 CET	65525	46600	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:25.564270020 CET	65525	46602	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:25.564333916 CET	46602	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:25.564333916 CET	46602	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:25.569212914 CET	65525	46602	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:27.333707094 CET	65525	46602	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:27.334054947 CET	46602	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:27.334662914 CET	46604	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:27.338922024 CET	65525	46602	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:27.339484930 CET	65525	46604	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:27.339572906 CET	46604	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:27.339597940 CET	46604	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:27.344396114 CET	65525	46604	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:29.112796068 CET	65525	46604	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:29.113183022 CET	46604	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:29.113976002 CET	46606	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:29.117960930 CET	65525	46604	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:29.118782043 CET	65525	46606	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:29.118858099 CET	46606	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:29.118886948 CET	46606	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:29.123697996 CET	65525	46606	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:30.895337105 CET	65525	46606	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:30.895673990 CET	46606	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:30.896383047 CET	46608	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:30.900532961 CET	65525	46606	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:30.901204109 CET	65525	46608	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:30.901273012 CET	46608	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:30.901273012 CET	46608	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:30.906117916 CET	65525	46608	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:32.678240061 CET	65525	46608	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:32.678452969 CET	46608	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:32.679003954 CET	46610	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:32.683322906 CET	65525	46608	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:32.683821917 CET	65525	46610	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:32.683878899 CET	46610	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:32.683895111 CET	46610	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:32.688622952 CET	65525	46610	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:34.455796003 CET	65525	46610	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:34.455986977 CET	46610	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:34.456520081 CET	46612	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:34.460872889 CET	65525	46610	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:34.461286068 CET	65525	46612	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:34.461347103 CET	46612	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:34.461508036 CET	46612	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:34.466269016 CET	65525	46612	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:36.237989902 CET	65525	46612	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:36.238128901 CET	46612	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:36.238651991 CET	46614	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:36.242867947 CET	65525	46612	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:36.243424892 CET	65525	46614	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:36.243480921 CET	46614	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:36.243534088 CET	46614	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:36.248409986 CET	65525	46614	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:38.018513918 CET	65525	46614	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:38.018795013 CET	46614	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:38.019355059 CET	46616	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:38.023606062 CET	65525	46614	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:38.024174929 CET	65525	46616	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:38.024288893 CET	46616	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:38.024343967 CET	46616	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:38.029119968 CET	65525	46616	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:39.798505068 CET	65525	46616	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:39.798759937 CET	46616	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:39.799273968 CET	46618	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:39.805135012 CET	65525	46616	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:39.805146933 CET	65525	46618	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:39.805227041 CET	46618	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:39.805239916 CET	46618	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:39.811192989 CET	65525	46618	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:41.593138933 CET	65525	46618	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:41.593312025 CET	46618	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:41.593786955 CET	46620	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:41.598073006 CET	65525	46618	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:41.598643064 CET	65525	46620	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:41.598697901 CET	46620	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:41.598709106 CET	46620	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:41.603444099 CET	65525	46620	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:43.383255959 CET	65525	46620	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:43.383430958 CET	46620	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:43.384057999 CET	46622	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:43.388273954 CET	65525	46620	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:43.388868093 CET	65525	46622	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:43.388919115 CET	46622	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:43.388969898 CET	46622	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:43.393695116 CET	65525	46622	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:45.171780109 CET	65525	46622	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:45.172025919 CET	46622	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:45.172869921 CET	46624	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:45.176887035 CET	65525	46622	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:45.177639961 CET	65525	46624	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:45.177720070 CET	46624	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:45.177750111 CET	46624	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:45.182487011 CET	65525	46624	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:46.976583004 CET	65525	46624	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:46.977020025 CET	46624	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:46.977662086 CET	46626	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:46.981913090 CET	65525	46624	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:46.982449055 CET	65525	46626	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:46.982530117 CET	46626	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:46.982562065 CET	46626	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:46.987343073 CET	65525	46626	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:48.772612095 CET	65525	46626	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:48.772842884 CET	46626	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:48.773369074 CET	46628	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:48.777637005 CET	65525	46626	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:48.778148890 CET	65525	46628	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:48.778242111 CET	46628	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:48.778254986 CET	46628	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:48.783013105 CET	65525	46628	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:50.545639038 CET	65525	46628	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:50.545938015 CET	46628	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:50.546538115 CET	46630	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:50.550724030 CET	65525	46628	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:50.551294088 CET	65525	46630	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:50.551470041 CET	46630	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:50.551470041 CET	46630	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:50.556284904 CET	65525	46630	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:52.336190939 CET	65525	46630	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:52.336532116 CET	46630	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:52.337343931 CET	46632	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:52.341270924 CET	65525	46630	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:52.342113972 CET	65525	46632	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:52.342197895 CET	46632	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:52.342223883 CET	46632	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:52.346954107 CET	65525	46632	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:54.131195068 CET	65525	46632	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:54.131685972 CET	46632	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:54.132380962 CET	46634	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:54.136492014 CET	65525	46632	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:54.137126923 CET	65525	46634	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:54.137223005 CET	46634	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:54.137254953 CET	46634	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:54.142045021 CET	65525	46634	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:55.890244007 CET	65525	46634	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:55.890403032 CET	46634	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:55.890850067 CET	46636	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:55.895272017 CET	65525	46634	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:55.895586967 CET	65525	46636	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:55.895641088 CET	46636	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:55.895652056 CET	46636	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:55.900463104 CET	65525	46636	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:57.673094034 CET	65525	46636	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:57.673264027 CET	46636	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:57.673764944 CET	46638	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:57.678097010 CET	65525	46636	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:57.678633928 CET	65525	46638	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:57.678719044 CET	46638	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:57.678746939 CET	46638	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:57.683499098 CET	65525	46638	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:59.464498997 CET	65525	46638	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:59.464627028 CET	46638	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:59.465069056 CET	46640	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:59.469393969 CET	65525	46638	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:59.469871998 CET	65525	46640	212.64.199.97	192.168.2.14
Jan 3, 2025 08:23:59.469922066 CET	46640	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:59.469922066 CET	46640	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:23:59.474729061 CET	65525	46640	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:01.240458965 CET	65525	46640	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:01.240573883 CET	46640	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:01.241225004 CET	46642	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:01.245379925 CET	65525	46640	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:01.246049881 CET	65525	46642	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:01.246115923 CET	46642	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:01.246115923 CET	46642	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:01.250983953 CET	65525	46642	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:03.023030996 CET	65525	46642	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:03.023375034 CET	46642	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:03.024065018 CET	46644	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:03.028156996 CET	65525	46642	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:03.028830051 CET	65525	46644	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:03.028911114 CET	46644	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:03.028934956 CET	46644	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:03.033662081 CET	65525	46644	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:04.810188055 CET	65525	46644	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:04.810389042 CET	46644	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:04.811002016 CET	46646	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:04.815160036 CET	65525	46644	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:04.815841913 CET	65525	46646	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:04.815895081 CET	46646	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:04.815937042 CET	46646	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:04.820769072 CET	65525	46646	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:06.598098993 CET	65525	46646	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:06.598375082 CET	46646	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:06.598993063 CET	46648	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:06.603174925 CET	65525	46646	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:06.603787899 CET	65525	46648	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:06.603842974 CET	46648	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:06.603854895 CET	46648	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:06.608604908 CET	65525	46648	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:08.512931108 CET	65525	46648	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:08.513056993 CET	46648	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:08.513590097 CET	46650	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:08.517911911 CET	65525	46648	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:08.518326044 CET	65525	46650	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:08.518435001 CET	46650	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:08.518435001 CET	46650	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:08.523353100 CET	65525	46650	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:10.300380945 CET	65525	46650	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:10.300507069 CET	46650	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:10.300990105 CET	46652	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:10.305342913 CET	65525	46650	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:10.305763960 CET	65525	46652	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:10.305819035 CET	46652	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:10.305833101 CET	46652	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:10.310580015 CET	65525	46652	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:12.082259893 CET	65525	46652	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:12.082427025 CET	46652	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:12.082967043 CET	46654	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:12.087204933 CET	65525	46652	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:12.087726116 CET	65525	46654	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:12.087786913 CET	46654	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:12.087786913 CET	46654	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:12.092606068 CET	65525	46654	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:13.869003057 CET	65525	46654	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:13.869168043 CET	46654	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:13.869647026 CET	46656	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:13.873953104 CET	65525	46654	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:13.874408960 CET	65525	46656	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:13.874458075 CET	46656	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:13.874468088 CET	46656	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:13.879195929 CET	65525	46656	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:15.640656948 CET	65525	46656	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:15.640868902 CET	46656	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:15.641422987 CET	46658	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:15.645716906 CET	65525	46656	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:15.646231890 CET	65525	46658	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:15.646286011 CET	46658	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:15.646297932 CET	46658	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:15.651051998 CET	65525	46658	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:17.436856985 CET	65525	46658	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:17.436974049 CET	46658	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:17.437520981 CET	46660	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:17.441750050 CET	65525	46658	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:17.442338943 CET	65525	46660	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:17.442442894 CET	46660	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:17.442464113 CET	46660	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:17.447673082 CET	65525	46660	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:19.208863974 CET	65525	46660	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:19.209033966 CET	46660	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:19.209568977 CET	46662	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:19.213915110 CET	65525	46660	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:19.214363098 CET	65525	46662	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:19.214449883 CET	46662	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:19.214449883 CET	46662	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:19.219296932 CET	65525	46662	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:21.011429071 CET	65525	46662	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:21.011571884 CET	46662	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:21.012177944 CET	46664	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:21.016318083 CET	65525	46662	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:21.016936064 CET	65525	46664	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:21.016993999 CET	46664	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:21.017030001 CET	46664	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:21.021744013 CET	65525	46664	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:22.814594984 CET	65525	46664	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:22.814769983 CET	46664	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:22.815438986 CET	46666	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:22.819595098 CET	65525	46664	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:22.820218086 CET	65525	46666	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:22.820269108 CET	46666	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:22.820281029 CET	46666	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:22.825001001 CET	65525	46666	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:24.578273058 CET	65525	46666	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:24.578619957 CET	46666	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:24.579647064 CET	46668	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:24.583401918 CET	65525	46666	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:24.584434986 CET	65525	46668	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:24.584523916 CET	46668	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:24.584566116 CET	46668	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:24.589329958 CET	65525	46668	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:26.363245964 CET	65525	46668	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:26.363735914 CET	46668	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:26.364518881 CET	46670	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:26.368551970 CET	65525	46668	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:26.369412899 CET	65525	46670	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:26.369499922 CET	46670	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:26.369534969 CET	46670	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:26.374313116 CET	65525	46670	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:28.146656036 CET	65525	46670	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:28.146924973 CET	46670	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:28.147644997 CET	46672	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:28.151767969 CET	65525	46670	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:28.152468920 CET	65525	46672	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:28.152533054 CET	46672	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:28.152564049 CET	46672	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:28.157337904 CET	65525	46672	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:29.926534891 CET	65525	46672	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:29.926903009 CET	46672	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:29.927582979 CET	46674	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:29.931638002 CET	65525	46672	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:29.932373047 CET	65525	46674	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:29.932435036 CET	46674	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:29.932468891 CET	46674	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:29.937186003 CET	65525	46674	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:31.709073067 CET	65525	46674	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:31.709448099 CET	46674	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:31.710251093 CET	46676	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:31.714258909 CET	65525	46674	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:31.715114117 CET	65525	46676	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:31.715193987 CET	46676	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:31.715245962 CET	46676	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:31.720025063 CET	65525	46676	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:33.511579037 CET	65525	46676	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:33.511781931 CET	46676	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:33.512696981 CET	46678	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:33.516623020 CET	65525	46676	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:33.517477036 CET	65525	46678	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:33.517554998 CET	46678	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:33.517601013 CET	46678	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:33.522411108 CET	65525	46678	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:35.322359085 CET	65525	46678	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:35.322654009 CET	46678	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:35.323273897 CET	46680	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:35.327518940 CET	65525	46678	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:35.328139067 CET	65525	46680	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:35.328202963 CET	46680	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:35.328222990 CET	46680	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:35.333018064 CET	65525	46680	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:37.275614977 CET	65525	46680	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:37.275851965 CET	46680	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:37.276542902 CET	46682	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:37.280639887 CET	65525	46680	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:37.281353951 CET	65525	46682	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:37.281415939 CET	46682	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:37.281438112 CET	46682	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:37.286196947 CET	65525	46682	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:39.072469950 CET	65525	46682	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:39.072704077 CET	46682	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:39.073283911 CET	46684	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:39.077492952 CET	65525	46682	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:39.078083992 CET	65525	46684	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:39.078182936 CET	46684	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:39.078248024 CET	46684	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:39.083026886 CET	65525	46684	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:40.869472027 CET	65525	46684	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:40.869678020 CET	46684	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:40.870428085 CET	46686	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:40.874525070 CET	65525	46684	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:40.875185013 CET	65525	46686	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:40.875297070 CET	46686	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:40.875308990 CET	46686	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:40.880095005 CET	65525	46686	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:42.640948057 CET	65525	46686	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:42.641096115 CET	46686	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:42.641531944 CET	46688	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:42.645904064 CET	65525	46686	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:42.646416903 CET	65525	46688	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:42.646471977 CET	46688	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:42.646488905 CET	46688	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:42.651273966 CET	65525	46688	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:44.422312975 CET	65525	46688	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:44.422508001 CET	46688	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:44.422996998 CET	46690	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:44.427381039 CET	65525	46688	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:44.427762985 CET	65525	46690	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:44.427850008 CET	46690	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:44.427898884 CET	46690	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:44.432671070 CET	65525	46690	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:46.213866949 CET	65525	46690	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:46.214059114 CET	46690	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:46.214870930 CET	46692	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:46.218839884 CET	65525	46690	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:46.219645023 CET	65525	46692	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:46.219769001 CET	46692	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:46.219863892 CET	46692	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:46.224580050 CET	65525	46692	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:47.987916946 CET	65525	46692	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:47.988131046 CET	46692	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:47.988792896 CET	46694	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:47.992959023 CET	65525	46692	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:47.993655920 CET	65525	46694	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:47.993711948 CET	46694	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:47.993721962 CET	46694	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:47.998511076 CET	65525	46694	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:49.750567913 CET	65525	46694	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:49.750780106 CET	46694	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:49.751486063 CET	46696	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:49.755599976 CET	65525	46694	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:49.756258965 CET	65525	46696	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:49.756325006 CET	46696	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:49.756367922 CET	46696	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:49.761092901 CET	65525	46696	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:51.517005920 CET	65525	46696	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:51.517203093 CET	46696	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:51.517710924 CET	46698	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:51.521991014 CET	65525	46696	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:51.522512913 CET	65525	46698	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:51.522571087 CET	46698	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:51.522571087 CET	46698	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:51.527360916 CET	65525	46698	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:53.287858009 CET	65525	46698	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:53.288158894 CET	46698	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:53.288841963 CET	46700	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:53.292987108 CET	65525	46698	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:53.293575048 CET	65525	46700	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:53.293682098 CET	46700	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:53.293682098 CET	46700	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:53.298532963 CET	65525	46700	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:55.090246916 CET	65525	46700	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:55.090564013 CET	46700	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:55.091336966 CET	46702	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:55.095323086 CET	65525	46700	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:55.096153021 CET	65525	46702	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:55.096237898 CET	46702	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:55.096292019 CET	46702	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:55.101073027 CET	65525	46702	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:56.885627985 CET	65525	46702	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:56.886017084 CET	46702	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:56.886820078 CET	46704	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:56.890847921 CET	65525	46702	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:56.891648054 CET	65525	46704	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:56.891691923 CET	46704	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:56.891704082 CET	46704	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:56.896487951 CET	65525	46704	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:58.682502985 CET	65525	46704	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:58.682770967 CET	46704	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:58.683490038 CET	46706	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:58.687637091 CET	65525	46704	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:58.688288927 CET	65525	46706	212.64.199.97	192.168.2.14
Jan 3, 2025 08:24:58.688363075 CET	46706	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:58.688397884 CET	46706	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:24:58.693149090 CET	65525	46706	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:00.471458912 CET	65525	46706	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:00.471683979 CET	46706	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:00.472306013 CET	46708	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:00.476552010 CET	65525	46706	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:00.477085114 CET	65525	46708	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:00.477171898 CET	46708	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:00.477226973 CET	46708	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:00.482002974 CET	65525	46708	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:02.245661020 CET	65525	46708	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:02.245877028 CET	46708	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:02.246603966 CET	46710	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:02.250710011 CET	65525	46708	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:02.251405001 CET	65525	46710	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:02.251467943 CET	46710	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:02.251513004 CET	46710	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:02.256247997 CET	65525	46710	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:04.040724039 CET	65525	46710	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:04.041013956 CET	46710	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:04.041840076 CET	46712	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:04.045890093 CET	65525	46710	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:04.046617031 CET	65525	46712	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:04.046700954 CET	46712	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:04.046752930 CET	46712	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:04.051516056 CET	65525	46712	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:05.858182907 CET	65525	46712	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:05.858515978 CET	46712	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:05.859369040 CET	46714	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:05.863352060 CET	65525	46712	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:05.864166975 CET	65525	46714	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:05.864228964 CET	46714	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:05.864263058 CET	46714	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:05.869034052 CET	65525	46714	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:07.625911951 CET	65525	46714	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:07.626182079 CET	46714	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:07.626794100 CET	46716	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:07.630990982 CET	65525	46714	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:07.631628036 CET	65525	46716	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:07.631705999 CET	46716	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:07.631705999 CET	46716	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:07.636466026 CET	65525	46716	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:09.393975973 CET	65525	46716	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:09.394186020 CET	46716	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:09.394774914 CET	46718	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:09.399213076 CET	65525	46716	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:09.399610996 CET	65525	46718	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:09.399729967 CET	46718	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:09.399730921 CET	46718	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:09.404572010 CET	65525	46718	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:11.183782101 CET	65525	46718	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:11.184154034 CET	46718	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:11.185050964 CET	46720	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:11.189083099 CET	65525	46718	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:11.189888000 CET	65525	46720	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:11.189976931 CET	46720	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:11.190052986 CET	46720	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:11.194813967 CET	65525	46720	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:12.969913960 CET	65525	46720	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:12.970055103 CET	46720	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:12.970721006 CET	46722	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:12.974869967 CET	65525	46720	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:12.975550890 CET	65525	46722	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:12.975600004 CET	46722	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:12.975661039 CET	46722	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:12.980480909 CET	65525	46722	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:14.756920099 CET	65525	46722	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:14.757122040 CET	46722	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:14.757751942 CET	46724	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:14.761965036 CET	65525	46722	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:14.762648106 CET	65525	46724	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:14.762734890 CET	46724	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:14.762788057 CET	46724	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:14.767652988 CET	65525	46724	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:16.537226915 CET	65525	46724	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:16.537419081 CET	46724	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:16.538108110 CET	46726	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:16.542237043 CET	65525	46724	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:16.542962074 CET	65525	46726	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:16.543051958 CET	46726	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:16.543051958 CET	46726	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:16.547864914 CET	65525	46726	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:18.323133945 CET	65525	46726	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:18.323515892 CET	46726	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:18.324229956 CET	46728	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:18.328373909 CET	65525	46726	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:18.329077005 CET	65525	46728	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:18.329132080 CET	46728	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:18.329144001 CET	46728	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:18.333942890 CET	65525	46728	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:20.102688074 CET	65525	46728	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:20.102827072 CET	46728	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:20.103410959 CET	46730	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:20.107664108 CET	65525	46728	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:20.108187914 CET	65525	46730	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:20.108280897 CET	46730	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:20.108292103 CET	46730	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:20.113085985 CET	65525	46730	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:21.907537937 CET	65525	46730	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:21.907713890 CET	46730	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:21.908304930 CET	46732	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:21.912560940 CET	65525	46730	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:21.913182974 CET	65525	46732	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:21.913243055 CET	46732	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:21.913255930 CET	46732	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:21.918068886 CET	65525	46732	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:23.679217100 CET	65525	46732	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:23.679645061 CET	46732	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:23.680602074 CET	46734	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:23.684521914 CET	65525	46732	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:23.685353994 CET	65525	46734	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:23.685444117 CET	46734	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:23.685467005 CET	46734	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:23.690249920 CET	65525	46734	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:25.460484982 CET	65525	46734	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:25.460890055 CET	46734	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:25.461414099 CET	46736	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:25.465728998 CET	65525	46734	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:25.466289997 CET	65525	46736	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:25.466368914 CET	46736	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:25.466383934 CET	46736	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:25.471103907 CET	65525	46736	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:27.242543936 CET	65525	46736	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:27.242800951 CET	46736	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:27.243505001 CET	46738	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:27.247632980 CET	65525	46736	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:27.248281002 CET	65525	46738	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:27.248359919 CET	46738	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:27.248409986 CET	46738	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:27.253190994 CET	65525	46738	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:29.017985106 CET	65525	46738	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:29.018364906 CET	46738	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:29.019253016 CET	46740	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:29.023190022 CET	65525	46738	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:29.024032116 CET	65525	46740	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:29.024112940 CET	46740	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:29.024144888 CET	46740	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:29.028913975 CET	65525	46740	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:30.805985928 CET	65525	46740	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:30.806375027 CET	46740	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:30.807003021 CET	46742	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:30.811214924 CET	65525	46740	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:30.811799049 CET	65525	46742	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:30.811852932 CET	46742	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:30.811852932 CET	46742	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:30.816662073 CET	65525	46742	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:32.597729921 CET	65525	46742	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:32.597889900 CET	46742	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:32.598702908 CET	46744	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:32.602700949 CET	65525	46742	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:32.603535891 CET	65525	46744	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:32.603634119 CET	46744	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:32.603665113 CET	46744	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:32.608378887 CET	65525	46744	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:34.383172035 CET	65525	46744	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:34.383368969 CET	46744	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:34.383944988 CET	46746	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:34.388169050 CET	65525	46744	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:34.388744116 CET	65525	46746	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:34.388808012 CET	46746	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:34.388808012 CET	46746	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:34.393640041 CET	65525	46746	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:36.183227062 CET	65525	46746	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:36.183393002 CET	46746	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:36.183986902 CET	46748	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:36.188256979 CET	65525	46746	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:36.188803911 CET	65525	46748	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:36.188889027 CET	46748	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:36.188889027 CET	46748	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:36.193686962 CET	65525	46748	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:37.982073069 CET	65525	46748	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:37.982377052 CET	46748	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:37.982954025 CET	46750	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:37.987266064 CET	65525	46748	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:37.987724066 CET	65525	46750	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:37.987842083 CET	46750	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:37.987891912 CET	46750	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:37.992680073 CET	65525	46750	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:39.778722048 CET	65525	46750	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:39.778872013 CET	46750	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:39.779614925 CET	46752	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:39.783798933 CET	65525	46750	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:39.784406900 CET	65525	46752	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:39.784449100 CET	46752	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:39.784449100 CET	46752	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:39.789217949 CET	65525	46752	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:41.554486036 CET	65525	46752	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:41.554721117 CET	46752	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:41.555326939 CET	46754	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:41.559604883 CET	65525	46752	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:41.560158014 CET	65525	46754	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:41.560242891 CET	46754	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:41.560242891 CET	46754	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:41.565046072 CET	65525	46754	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:43.356271982 CET	65525	46754	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:43.356558084 CET	46754	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:43.357080936 CET	46756	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:43.362493992 CET	65525	46754	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:43.363008976 CET	65525	46756	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:43.363068104 CET	46756	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:43.363080025 CET	46756	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:43.367919922 CET	65525	46756	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:45.167413950 CET	65525	46756	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:45.167676926 CET	46756	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:45.168431044 CET	46758	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:45.172446012 CET	65525	46756	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:45.173295975 CET	65525	46758	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:45.173393011 CET	46758	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:45.173404932 CET	46758	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:45.178155899 CET	65525	46758	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:46.944849968 CET	65525	46758	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:46.945040941 CET	46758	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:46.945630074 CET	46760	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:46.949877024 CET	65525	46758	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:46.950473070 CET	65525	46760	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:46.950555086 CET	46760	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:46.950587034 CET	46760	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:46.959899902 CET	65525	46760	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:48.726476908 CET	65525	46760	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:48.726847887 CET	46760	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:48.727467060 CET	46762	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:48.731702089 CET	65525	46760	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:48.732317924 CET	65525	46762	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:48.732372999 CET	46762	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:48.732420921 CET	46762	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:48.737201929 CET	65525	46762	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:50.509587049 CET	65525	46762	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:50.509949923 CET	46762	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:50.510603905 CET	46764	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:50.514802933 CET	65525	46762	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:50.515445948 CET	65525	46764	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:50.515530109 CET	46764	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:50.515585899 CET	46764	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:50.520343065 CET	65525	46764	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:52.284009933 CET	65525	46764	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:52.284238100 CET	46764	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:52.284842968 CET	46766	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:52.289071083 CET	65525	46764	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:52.289671898 CET	65525	46766	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:52.289720058 CET	46766	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:52.289733887 CET	46766	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:52.294534922 CET	65525	46766	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:54.054043055 CET	65525	46766	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:54.054265022 CET	46766	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:54.054873943 CET	46768	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:54.059052944 CET	65525	46766	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:54.059645891 CET	65525	46768	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:54.059688091 CET	46768	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:54.059710979 CET	46768	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:54.064466000 CET	65525	46768	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:55.842623949 CET	65525	46768	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:55.842987061 CET	46768	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:55.843779087 CET	46770	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:55.847876072 CET	65525	46768	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:55.848583937 CET	65525	46770	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:55.848665953 CET	46770	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:55.848718882 CET	46770	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:55.853528023 CET	65525	46770	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:57.642818928 CET	65525	46770	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:57.643049002 CET	46770	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:57.643904924 CET	46772	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:57.647871017 CET	65525	46770	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:57.648783922 CET	65525	46772	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:57.648880959 CET	46772	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:57.648952007 CET	46772	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:57.653738022 CET	65525	46772	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:59.441761017 CET	65525	46772	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:59.442164898 CET	46772	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:59.443042994 CET	46774	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:59.446984053 CET	65525	46772	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:59.447793961 CET	65525	46774	212.64.199.97	192.168.2.14
Jan 3, 2025 08:25:59.447882891 CET	46774	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:59.447916031 CET	46774	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:25:59.452681065 CET	65525	46774	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:01.226741076 CET	65525	46774	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:01.227026939 CET	46774	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:01.227124929 CET	46774	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:01.227798939 CET	46776	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:01.231919050 CET	65525	46774	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:01.232554913 CET	65525	46776	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:01.232639074 CET	46776	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:01.232670069 CET	46776	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:01.237366915 CET	65525	46776	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:02.543266058 CET	45346	53	192.168.2.14	8.8.8.8
Jan 3, 2025 08:26:02.566283941 CET	53	45346	8.8.8.8	192.168.2.14
Jan 3, 2025 08:26:02.566338062 CET	45346	53	192.168.2.14	8.8.8.8
Jan 3, 2025 08:26:02.566370010 CET	45346	53	192.168.2.14	8.8.8.8
Jan 3, 2025 08:26:02.566396952 CET	45346	53	192.168.2.14	8.8.8.8
Jan 3, 2025 08:26:02.571341991 CET	53	45346	8.8.8.8	192.168.2.14
Jan 3, 2025 08:26:02.571352005 CET	53	45346	8.8.8.8	192.168.2.14
Jan 3, 2025 08:26:03.006289959 CET	65525	46776	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:03.006366014 CET	46776	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:03.007215023 CET	46780	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:03.011149883 CET	65525	46776	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:03.012088060 CET	65525	46780	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:03.012140036 CET	46780	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:03.012154102 CET	46780	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:03.016879082 CET	65525	46780	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:03.031708956 CET	53	45346	8.8.8.8	192.168.2.14
Jan 3, 2025 08:26:03.031758070 CET	45346	53	192.168.2.14	8.8.8.8
Jan 3, 2025 08:26:04.768789053 CET	65525	46780	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:04.769032955 CET	46780	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:04.769511938 CET	46782	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:04.773824930 CET	65525	46780	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:04.774298906 CET	65525	46782	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:04.774363995 CET	46782	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:04.774363995 CET	46782	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:04.779118061 CET	65525	46782	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:05.030689001 CET	53	45346	8.8.8.8	192.168.2.14
Jan 3, 2025 08:26:05.030929089 CET	45346	53	192.168.2.14	8.8.8.8
Jan 3, 2025 08:26:05.035763979 CET	53	45346	8.8.8.8	192.168.2.14
Jan 3, 2025 08:26:06.574209929 CET	65525	46782	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:06.574336052 CET	46782	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:06.574870110 CET	46784	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:06.579128027 CET	65525	46782	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:06.579618931 CET	65525	46784	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:06.579674959 CET	46784	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:06.579674959 CET	46784	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:06.584458113 CET	65525	46784	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:08.384964943 CET	65525	46784	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:08.385088921 CET	46784	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:08.385561943 CET	46786	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:08.389857054 CET	65525	46784	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:08.390312910 CET	65525	46786	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:08.390371084 CET	46786	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:08.390371084 CET	46786	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:08.395184040 CET	65525	46786	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:10.160643101 CET	65525	46786	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:10.160916090 CET	46786	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:10.161349058 CET	46788	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:10.165745020 CET	65525	46786	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:10.166209936 CET	65525	46788	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:10.166266918 CET	46788	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:10.166281939 CET	46788	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:10.171053886 CET	65525	46788	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:11.943617105 CET	65525	46788	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:11.943872929 CET	46788	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:11.944350004 CET	46790	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:11.948717117 CET	65525	46788	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:11.949124098 CET	65525	46790	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:11.949181080 CET	46790	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:11.949194908 CET	46790	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:11.953922987 CET	65525	46790	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:13.725929976 CET	65525	46790	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:13.726273060 CET	46790	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:13.726696968 CET	46792	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:13.731183052 CET	65525	46790	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:13.731551886 CET	65525	46792	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:13.731611013 CET	46792	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:13.731622934 CET	46792	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:13.736430883 CET	65525	46792	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:15.510339022 CET	65525	46792	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:15.510557890 CET	46792	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:15.510993004 CET	46794	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:15.515351057 CET	65525	46792	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:15.515834093 CET	65525	46794	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:15.515885115 CET	46794	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:15.515897989 CET	46794	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:15.520637989 CET	65525	46794	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:17.310883045 CET	65525	46794	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:17.311278105 CET	46794	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:17.311827898 CET	46796	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:17.317509890 CET	65525	46794	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:17.317522049 CET	65525	46796	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:17.317598104 CET	46796	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:17.317651987 CET	46796	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:17.322423935 CET	65525	46796	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:19.096345901 CET	65525	46796	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:19.096716881 CET	46796	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:19.097291946 CET	46798	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:19.101557016 CET	65525	46796	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:19.102083921 CET	65525	46798	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:19.102138042 CET	46798	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:19.102184057 CET	46798	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:19.106936932 CET	65525	46798	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:20.887128115 CET	65525	46798	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:20.887587070 CET	46798	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:20.888117075 CET	46800	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:20.892416000 CET	65525	46798	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:20.893100023 CET	65525	46800	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:20.893156052 CET	46800	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:20.893203020 CET	46800	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:20.897975922 CET	65525	46800	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:22.659022093 CET	65525	46800	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:22.659353971 CET	46800	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:22.659796953 CET	46802	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:22.664180040 CET	65525	46800	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:22.664639950 CET	65525	46802	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:22.664725065 CET	46802	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:22.664761066 CET	46802	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:22.669538975 CET	65525	46802	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:24.457463980 CET	65525	46802	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:24.457760096 CET	46802	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:24.458386898 CET	46804	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:24.462629080 CET	65525	46802	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:24.463180065 CET	65525	46804	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:24.463233948 CET	46804	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:24.463265896 CET	46804	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:24.468081951 CET	65525	46804	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:26.242973089 CET	65525	46804	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:26.243271112 CET	46804	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:26.243804932 CET	46806	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:26.248080969 CET	65525	46804	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:26.248545885 CET	65525	46806	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:26.248625040 CET	46806	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:26.248663902 CET	46806	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:26.253418922 CET	65525	46806	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:28.023860931 CET	65525	46806	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:28.024096966 CET	46806	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:28.024540901 CET	46808	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:28.028883934 CET	65525	46806	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:28.029385090 CET	65525	46808	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:28.029448032 CET	46808	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:28.029463053 CET	46808	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:28.035366058 CET	65525	46808	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:29.826761007 CET	65525	46808	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:29.827150106 CET	46808	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:29.827775002 CET	46810	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:29.831964970 CET	65525	46808	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:29.832500935 CET	65525	46810	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:29.832585096 CET	46810	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:29.832636118 CET	46810	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:29.837431908 CET	65525	46810	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:31.624646902 CET	65525	46810	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:31.625020027 CET	46810	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:31.625823975 CET	46812	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:31.630788088 CET	65525	46810	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:31.631479025 CET	65525	46812	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:31.631556034 CET	46812	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:31.631593943 CET	46812	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:31.636322975 CET	65525	46812	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:33.421274900 CET	65525	46812	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:33.421516895 CET	46812	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:33.422135115 CET	46814	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:33.426318884 CET	65525	46812	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:33.426958084 CET	65525	46814	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:33.427016020 CET	46814	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:33.427027941 CET	46814	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:33.431827068 CET	65525	46814	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:35.191874027 CET	65525	46814	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:35.192248106 CET	46814	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:35.193008900 CET	46816	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:35.197122097 CET	65525	46814	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:35.197873116 CET	65525	46816	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:35.197935104 CET	46816	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:35.197935104 CET	46816	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:35.202769995 CET	65525	46816	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:36.981285095 CET	65525	46816	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:36.981679916 CET	46816	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:36.982328892 CET	46818	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:36.986577988 CET	65525	46816	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:36.987108946 CET	65525	46818	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:36.987176895 CET	46818	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:36.987178087 CET	46818	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:36.992480040 CET	65525	46818	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:38.780791044 CET	65525	46818	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:38.781004906 CET	46818	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:38.781584978 CET	46820	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:38.786789894 CET	65525	46818	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:38.787380934 CET	65525	46820	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:38.787430048 CET	46820	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:38.787442923 CET	46820	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:38.792999983 CET	65525	46820	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:40.575414896 CET	65525	46820	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:40.575786114 CET	46820	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:40.576375008 CET	46822	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:40.580537081 CET	65525	46820	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:40.581140041 CET	65525	46822	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:40.581218958 CET	46822	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:40.581229925 CET	46822	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:40.586007118 CET	65525	46822	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:42.375360012 CET	65525	46822	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:42.375648022 CET	46822	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:42.376252890 CET	46824	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:42.380498886 CET	65525	46822	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:42.380996943 CET	65525	46824	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:42.381051064 CET	46824	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:42.381064892 CET	46824	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:42.385835886 CET	65525	46824	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:44.149307013 CET	65525	46824	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:44.149457932 CET	46824	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:44.149986029 CET	46826	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:44.154236078 CET	65525	46824	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:44.154776096 CET	65525	46826	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:44.154856920 CET	46826	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:44.154856920 CET	46826	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:44.159605026 CET	65525	46826	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:45.929991961 CET	65525	46826	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:45.930372000 CET	46826	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:45.930913925 CET	46828	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:45.935134888 CET	65525	46826	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:45.935642004 CET	65525	46828	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:45.935728073 CET	46828	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:45.935784101 CET	46828	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:45.940531015 CET	65525	46828	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:47.690768003 CET	65525	46828	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:47.690994024 CET	46828	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:47.691731930 CET	46830	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:47.695738077 CET	65525	46828	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:47.699573040 CET	65525	46830	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:47.699675083 CET	46830	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:47.699675083 CET	46830	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:47.705022097 CET	65525	46830	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:49.484999895 CET	65525	46830	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:49.485609055 CET	46830	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:49.486291885 CET	46832	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:49.490447998 CET	65525	46830	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:49.491089106 CET	65525	46832	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:49.491163015 CET	46832	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:49.491163015 CET	46832	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:49.495915890 CET	65525	46832	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:51.253525019 CET	65525	46832	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:51.253901958 CET	46832	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:51.254642010 CET	46834	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:51.258718967 CET	65525	46832	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:51.259398937 CET	65525	46834	212.64.199.97	192.168.2.14
Jan 3, 2025 08:26:51.259475946 CET	46834	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:51.259509087 CET	46834	65525	192.168.2.14	212.64.199.97
Jan 3, 2025 08:26:51.264225006 CET	65525	46834	212.64.199.97	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 3, 2025 08:26:02.566370010 CET	192.168.2.14	8.8.8.8	0x4db7	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 3, 2025 08:26:02.566396952 CET	192.168.2.14	8.8.8.8	0x1aa8	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 3, 2025 08:26:03.031708956 CET	8.8.8.8	192.168.2.14	0x4db7	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Jan 3, 2025 08:26:03.031708956 CET	8.8.8.8	192.168.2.14	0x4db7	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: x86_64.elf PID: 5554, Parent PID: 5473

General

Start time (UTC):	07:23:15
Start date (UTC):	03/01/2025
Path:	/tmp/x86_64.elf
Arguments:	/tmp/x86_64.elf
File size:	67604 bytes
MD5 hash:	33127be57dc9ff0d1ef1f51e613c5517

Chronological Activities

Analysis Process: x86_64.elf PID: 5555, Parent PID: 5554

General

Start time (UTC):	07:23:16
Start date (UTC):	03/01/2025
Path:	/tmp/x86_64.elf
Arguments:	-
File size:	67604 bytes
MD5 hash:	33127be57dc9ff0d1ef1f51e613c5517

Chronological Activities

Analysis Process: x86_64.elf PID: 5556, Parent PID: 5555

General

Start time (UTC):	07:23:16
Start date (UTC):	03/01/2025
Path:	/tmp/x86_64.elf
Arguments:	-
File size:	67604 bytes
MD5 hash:	33127be57dc9ff0d1ef1f51e613c5517

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report x86_64.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/Infected.log

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: x86_64.elf PID: 5554, Parent PID: 5473

General

Chronological Activities

Analysis Process: x86_64.elf PID: 5555, Parent PID: 5554

General

Chronological Activities

Analysis Process: x86_64.elf PID: 5556, Parent PID: 5555

General

Chronological Activities

Linux Analysis Report
x86_64.elf