Edit tour

Linux Analysis Report
fenty.arm5.elf

Overview

General Information

Sample name:	fenty.arm5.elf
Analysis ID:	1586985
MD5:	3bd4793afb36f5ff6b3cd027207512c6
SHA1:	db90a5282fe28a69d0eb8beae2a6e0da24e3d149
SHA256:	14f494c93316671d2145fcad6044cda2227b2e2b9cd5c6ee31f206cebf2e17d6
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample deletes itself

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Sample contains only a LOAD segment without any section mappings

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1586985
Start date and time:	2025-01-09 20:32:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	fenty.arm5.elf
Detection:	MAL
Classification:	mal72.troj.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/fenty.arm5.elf
PID:	6217
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Hello, World!
Standard Error:

Process Tree

system is lnxubuntu20

fenty.arm5.elf (PID: 6217, Parent: 6136, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/fenty.arm5.elf

fenty.arm5.elf New Fork (PID: 6221, Parent: 6217)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
6217.1.00007fac7c017000.00007fac7c024000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6217.1.00007fac7c017000.00007fac7c024000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xbf88:$x2: /dev/misc/watchdog 0xbf78:$x3: /dev/watchdog 0xbfc4:$x3: /dev/watchdog 0xc138:$s1: LCOGQGPTGP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: fenty.arm5.elf

ReversingLabs: Detection: 13%

Source: global traffic

TCP traffic: 192.168.2.23:50704 -> 185.196.9.234:2969

Source: /tmp/fenty.arm5.elf (PID: 6217)

Socket: 0.0.0.0:54721

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.234

Source: fenty.arm5.elf

String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 6217.1.00007fac7c017000.00007fac7c024000.r-x.sdmp, type: MEMORY

Matched rule: Detects Mirai Botnet Malware Author: Florian Roth

Source: LOAD without section mappings

Program segment: 0x8000

Source: 6217.1.00007fac7c017000.00007fac7c024000.r-x.sdmp, type: MEMORY

Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b

Source: classification engine

Classification label: mal72.troj.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/fenty.arm5.elf (PID: 6217)

File: /tmp/fenty.arm5.elf

Jump to behavior

Source: fenty.arm5.elf

Submission file: segment LOAD with 7.6883 entropy (max. 8.0)

Source: /tmp/fenty.arm5.elf (PID: 6217)

Queries kernel information via 'uname':

Jump to behavior

Source: fenty.arm5.elf, 6217.1.000055ab8ef50000.000055ab8f09e000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: fenty.arm5.elf, 6217.1.000055ab8ef50000.000055ab8f09e000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: fenty.arm5.elf, 6217.1.00007fff95982000.00007fff959a3000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: fenty.arm5.elf, 6217.1.00007fff95982000.00007fff959a3000.rw-.sdmp	Binary or memory string: (x86_64/usr/bin/qemu-arm/tmp/fenty.arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/fenty.arm5.elf

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match

File source: 6217.1.00007fac7c017000.00007fac7c024000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match

File source: 6217.1.00007fac7c017000.00007fac7c024000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
fenty.arm5.elf	13%	ReversingLabs

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	fenty.arm5.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
185.196.9.234	unknown	Switzerland	42624	SIMPLECARRIERCH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
185.196.9.234	fenty.arm5.elf	Get hash	malicious	Mirai	Browse
	fenty.arm5.elf	Get hash	malicious	Mirai	Browse
	fenty.arm5.elf	Get hash	malicious	Mirai	Browse
	fenty.arm5.elf	Get hash	malicious	Mirai	Browse
91.189.91.43	wind.x86.elf	Get hash	malicious	Mirai	Browse
	wind.mpsl.elf	Get hash	malicious	Mirai	Browse
	wind.arm6.elf	Get hash	malicious	Mirai	Browse
	Fantazy.arc.elf	Get hash	malicious	Unknown	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	main_arm.elf	Get hash	malicious	Mirai	Browse
	i.elf	Get hash	malicious	Unknown	Browse
	main_arm.elf	Get hash	malicious	Mirai	Browse
	main_x86.elf	Get hash	malicious	Mirai	Browse
	2.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	wind.x86.elf	Get hash	malicious	Mirai	Browse
	wind.mpsl.elf	Get hash	malicious	Mirai	Browse
	wind.arm6.elf	Get hash	malicious	Mirai	Browse
	Fantazy.arc.elf	Get hash	malicious	Unknown	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	main_arm.elf	Get hash	malicious	Mirai	Browse
	i.elf	Get hash	malicious	Unknown	Browse
	main_arm.elf	Get hash	malicious	Mirai	Browse
	main_x86.elf	Get hash	malicious	Mirai	Browse
	2.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	wind.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wind.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wind.arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wind.arm5.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	main_ppc.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	.i.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	Fantazy.arc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	main_arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_x86.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
CANONICAL-ASGB	wind.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wind.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wind.arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wind.arm5.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	main_ppc.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	.i.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	Fantazy.arc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	main_arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_x86.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
SIMPLECARRIERCH	fenty.arm5.elf	Get hash	malicious	Mirai	Browse	185.196.9.234
	fenty.arm5.elf	Get hash	malicious	Mirai	Browse	185.196.9.234
	fenty.arm5.elf	Get hash	malicious	Mirai	Browse	185.196.9.234
	fenty.arm5.elf	Get hash	malicious	Mirai	Browse	185.196.9.234
	sparc.elf	Get hash	malicious	Mirai	Browse	185.196.10.127
	armv6l.elf	Get hash	malicious	Mirai	Browse	185.196.10.127
	sh4.elf	Get hash	malicious	Mirai	Browse	185.196.10.127
	mips.elf	Get hash	malicious	Mirai	Browse	185.196.10.127
	mipsel.elf	Get hash	malicious	Mirai	Browse	185.196.10.127
	x86_64.elf	Get hash	malicious	Mirai	Browse	185.196.10.127
INIT7CH	wind.x86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	wind.mpsl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	wind.arm6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Fantazy.arc.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	main_arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	85.195.212.32
	i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	main_arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_x86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, no section header
Entropy (8bit):	7.682886662565367
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	fenty.arm5.elf
File size:	22'276 bytes
MD5:	3bd4793afb36f5ff6b3cd027207512c6
SHA1:	db90a5282fe28a69d0eb8beae2a6e0da24e3d149
SHA256:	14f494c93316671d2145fcad6044cda2227b2e2b9cd5c6ee31f206cebf2e17d6
SHA512:	34471d773f2f43882d7f6d29fc53dfd0732d39ae410397f8979f789870f54da3567f7f6877f618eaa3e788051db44a4c19632ad82f78eb377db1015fe25e6bbe
SSDEEP:	384:D91ltcjAe9TG7sIhcnI+d+cVNHRqUSGHLd2O6YMxh2yXoEvlEkn1kxhTp/f0Bp:D9XqkwTGIn3+iRqUS65v0YECJdCp
TLSH:	7EA2C002E580845FCF0B01BAB00FD33D9F4B7AAB3ADA56781C94798DA80F5E4A515F87
File Content Preview:	.ELF...a..........(.........4...........4. ...(......................V...V...............I..........................Q.td................................Gde!T...................U.........ELF.ra....(........4....... ........g..g......._......F,.@h.....Q.t.d

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0xccd0
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8000	0x8000	0x560b	0x560b	7.6883	0x5	R E	0x8000
LOAD	0x4918	0x1c918	0x1c918	0x0	0x0	0.0000	0x6	RW	0x8000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 20:32:51.288827896 CET	43928	443	192.168.2.23	91.189.91.42
Jan 9, 2025 20:32:53.000336885 CET	50704	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:53.005844116 CET	2969	50704	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:53.005935907 CET	50704	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:53.019524097 CET	50704	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:53.024904966 CET	2969	50704	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:53.024975061 CET	50704	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:53.030294895 CET	2969	50704	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:53.708123922 CET	2969	50704	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:53.708444118 CET	50704	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:53.708630085 CET	50704	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:53.709305048 CET	50706	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:53.714435101 CET	2969	50706	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:53.714519024 CET	50706	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:53.715183973 CET	50706	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:53.720040083 CET	2969	50706	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:53.720109940 CET	50706	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:53.725205898 CET	2969	50706	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:54.384958982 CET	2969	50706	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:54.385679007 CET	50706	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:54.385679960 CET	50706	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:54.387109995 CET	50708	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:54.392375946 CET	2969	50708	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:54.392474890 CET	50708	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:54.393619061 CET	50708	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:54.398663044 CET	2969	50708	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:54.398915052 CET	50708	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:54.403781891 CET	2969	50708	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:55.089807987 CET	2969	50708	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:55.090171099 CET	50708	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:55.090401888 CET	50708	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:55.091218948 CET	50710	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:55.096852064 CET	2969	50710	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:55.097062111 CET	50710	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:55.098099947 CET	50710	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:55.103069067 CET	2969	50710	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:55.103218079 CET	50710	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:55.108071089 CET	2969	50710	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:55.772666931 CET	2969	50710	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:55.773032904 CET	50710	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:55.773139954 CET	50710	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:55.773787022 CET	50712	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:55.778832912 CET	2969	50712	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:55.778920889 CET	50712	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:55.779866934 CET	50712	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:55.784873009 CET	2969	50712	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:55.785144091 CET	50712	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:55.790002108 CET	2969	50712	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:56.464683056 CET	2969	50712	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:56.465329885 CET	50712	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:56.465329885 CET	50712	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:56.466903925 CET	50714	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:56.472346067 CET	2969	50714	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:56.472687006 CET	50714	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:56.473767042 CET	50714	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:56.479156971 CET	2969	50714	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:56.479434967 CET	50714	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:56.484658957 CET	2969	50714	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:56.919806957 CET	42836	443	192.168.2.23	91.189.91.43
Jan 9, 2025 20:32:57.176749945 CET	2969	50714	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:57.177367926 CET	50714	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:57.177367926 CET	50714	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:57.178644896 CET	50716	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:57.183837891 CET	2969	50716	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:57.184027910 CET	50716	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:57.185272932 CET	50716	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:57.190237045 CET	2969	50716	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:57.190424919 CET	50716	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:57.195348978 CET	2969	50716	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:57.687851906 CET	42516	80	192.168.2.23	109.202.202.202
Jan 9, 2025 20:32:57.911665916 CET	2969	50716	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:57.912189007 CET	50716	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:57.912189007 CET	50716	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:57.913568974 CET	50718	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:57.918723106 CET	2969	50718	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:57.918879986 CET	50718	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:57.919735909 CET	50718	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:57.924592018 CET	2969	50718	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:57.924812078 CET	50718	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:57.929650068 CET	2969	50718	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:58.627211094 CET	2969	50718	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:58.627605915 CET	50718	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:58.627605915 CET	50718	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:58.628895998 CET	50720	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:58.633944988 CET	2969	50720	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:58.634139061 CET	50720	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:58.635473013 CET	50720	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:58.640607119 CET	2969	50720	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:58.640785933 CET	50720	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:58.646050930 CET	2969	50720	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:59.333492994 CET	2969	50720	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:59.334068060 CET	50720	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:59.334068060 CET	50720	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:59.334759951 CET	50722	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:59.340086937 CET	2969	50722	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:59.340257883 CET	50722	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:59.341126919 CET	50722	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:59.346256018 CET	2969	50722	185.196.9.234	192.168.2.23
Jan 9, 2025 20:32:59.346334934 CET	50722	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:32:59.351902962 CET	2969	50722	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:00.053327084 CET	2969	50722	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:00.053982019 CET	50722	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:00.053982019 CET	50722	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:00.055191040 CET	50724	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:00.060214996 CET	2969	50724	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:00.060398102 CET	50724	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:00.061088085 CET	50724	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:00.066169024 CET	2969	50724	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:00.066386938 CET	50724	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:00.071645975 CET	2969	50724	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:00.757576942 CET	2969	50724	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:00.758013964 CET	50724	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:00.758014917 CET	50724	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:00.759663105 CET	50726	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:00.764730930 CET	2969	50726	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:00.764863014 CET	50726	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:00.765811920 CET	50726	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:00.770652056 CET	2969	50726	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:00.770719051 CET	50726	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:00.775722980 CET	2969	50726	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:01.474903107 CET	2969	50726	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:01.475415945 CET	50726	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:01.475416899 CET	50726	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:01.476651907 CET	50728	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:01.481942892 CET	2969	50728	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:01.482544899 CET	50728	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:01.483752012 CET	50728	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:01.488764048 CET	2969	50728	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:01.489097118 CET	50728	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:01.493998051 CET	2969	50728	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:02.163578987 CET	2969	50728	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:02.164206982 CET	50728	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:02.164321899 CET	50728	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:02.166340113 CET	50730	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:02.171433926 CET	2969	50730	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:02.171675920 CET	50730	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:02.173427105 CET	50730	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:02.178591967 CET	2969	50730	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:02.178816080 CET	50730	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:02.183748007 CET	2969	50730	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:02.892241001 CET	2969	50730	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:02.892817974 CET	50730	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:02.892817974 CET	50730	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:02.894532919 CET	50732	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:02.899682999 CET	2969	50732	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:02.899905920 CET	50732	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:02.902072906 CET	50732	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:02.907335043 CET	2969	50732	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:02.907689095 CET	50732	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:02.912947893 CET	2969	50732	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:03.620683908 CET	2969	50732	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:03.621176958 CET	50732	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:03.621176958 CET	50732	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:03.622637987 CET	50734	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:03.627671003 CET	2969	50734	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:03.627759933 CET	50734	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:03.629384041 CET	50734	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:03.634430885 CET	2969	50734	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:03.634812117 CET	50734	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:03.640405893 CET	2969	50734	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:04.306736946 CET	2969	50734	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:04.307023048 CET	50734	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:04.307106972 CET	50734	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:04.307871103 CET	50736	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:04.312777042 CET	2969	50736	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:04.312899113 CET	50736	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:04.314256907 CET	50736	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:04.319099903 CET	2969	50736	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:04.319181919 CET	50736	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:04.324006081 CET	2969	50736	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:04.996963978 CET	2969	50736	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:04.997490883 CET	50736	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:04.997576952 CET	50736	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:04.999036074 CET	50738	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:05.004225969 CET	2969	50738	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:05.004446030 CET	50738	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:05.006407022 CET	50738	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:05.011358976 CET	2969	50738	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:05.011754036 CET	50738	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:05.016942024 CET	2969	50738	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:05.710529089 CET	2969	50738	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:05.711040974 CET	50738	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:05.711040974 CET	50738	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:05.713006973 CET	50740	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:05.718471050 CET	2969	50740	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:05.718944073 CET	50740	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:05.720494986 CET	50740	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:05.725644112 CET	2969	50740	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:05.725769997 CET	50740	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:05.731051922 CET	2969	50740	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:06.558172941 CET	2969	50740	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:06.558729887 CET	50740	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:06.558729887 CET	50740	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:06.560987949 CET	50742	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:06.566044092 CET	2969	50742	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:06.566481113 CET	50742	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:06.568608999 CET	50742	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:06.573725939 CET	2969	50742	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:06.573980093 CET	50742	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:06.578932047 CET	2969	50742	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:07.384217978 CET	2969	50742	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:07.384793997 CET	50742	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:07.384793997 CET	50742	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:07.386308908 CET	50744	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:07.391268015 CET	2969	50744	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:07.391365051 CET	50744	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:07.393316984 CET	50744	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:07.398209095 CET	2969	50744	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:07.398286104 CET	50744	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:07.403456926 CET	2969	50744	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:08.760557890 CET	2969	50744	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:08.761176109 CET	50744	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:08.761177063 CET	50744	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:08.764307976 CET	50746	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:08.769651890 CET	2969	50746	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:08.770060062 CET	50746	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:08.773123980 CET	50746	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:08.778382063 CET	2969	50746	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:08.778929949 CET	50746	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:08.784534931 CET	2969	50746	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:09.879261971 CET	2969	50746	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:09.879817009 CET	50746	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:09.880033970 CET	50746	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:09.882137060 CET	50748	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:09.887727022 CET	2969	50748	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:09.888000011 CET	50748	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:09.890744925 CET	50748	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:09.896285057 CET	2969	50748	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:09.896528959 CET	50748	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:09.902172089 CET	2969	50748	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:10.745161057 CET	2969	50748	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:10.745508909 CET	50748	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:10.745734930 CET	50748	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:10.748538017 CET	50750	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:10.754049063 CET	2969	50750	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:10.754165888 CET	50750	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:10.756987095 CET	50750	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:10.762319088 CET	2969	50750	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:10.762784004 CET	50750	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:10.768204927 CET	2969	50750	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:11.492697954 CET	2969	50750	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:11.493419886 CET	50750	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:11.493529081 CET	50750	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:11.495918036 CET	50752	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:11.501456022 CET	2969	50752	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:11.501605988 CET	50752	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:11.504437923 CET	50752	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:11.509814024 CET	43928	443	192.168.2.23	91.189.91.42
Jan 9, 2025 20:33:11.509932995 CET	2969	50752	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:11.510330915 CET	50752	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:11.515897989 CET	2969	50752	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:12.489958048 CET	2969	50752	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:12.490552902 CET	50752	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:12.490552902 CET	50752	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:12.492400885 CET	50754	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:12.498080015 CET	2969	50754	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:12.498555899 CET	50754	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:12.500283957 CET	50754	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:12.505521059 CET	2969	50754	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:12.505861044 CET	50754	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:12.511765003 CET	2969	50754	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:14.172826052 CET	2969	50754	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:14.173459053 CET	50754	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:14.173459053 CET	50754	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:14.175762892 CET	50756	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:14.181395054 CET	2969	50756	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:14.181833029 CET	50756	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:14.184138060 CET	50756	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:14.190083981 CET	2969	50756	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:14.190567970 CET	50756	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:14.196511984 CET	2969	50756	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:14.847917080 CET	2969	50756	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:14.848726034 CET	50756	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:14.848726034 CET	50756	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:14.850725889 CET	50758	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:14.856312990 CET	2969	50758	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:14.856650114 CET	50758	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:14.859504938 CET	50758	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:14.864850044 CET	2969	50758	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:14.864953041 CET	50758	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:14.870773077 CET	2969	50758	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:15.578371048 CET	2969	50758	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:15.578932047 CET	50758	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:15.578932047 CET	50758	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:15.581739902 CET	50760	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:15.586997032 CET	2969	50760	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:15.587281942 CET	50760	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:15.589975119 CET	50760	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:15.595654011 CET	2969	50760	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:15.595911026 CET	50760	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:15.601454020 CET	2969	50760	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:16.263725042 CET	2969	50760	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:16.264503002 CET	50760	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:16.264503002 CET	50760	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:16.266772985 CET	50762	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:16.272634029 CET	2969	50762	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:16.272916079 CET	50762	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:16.275752068 CET	50762	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:16.281315088 CET	2969	50762	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:16.281832933 CET	50762	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:16.287729979 CET	2969	50762	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:16.944760084 CET	2969	50762	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:16.944933891 CET	50762	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:16.944933891 CET	50762	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:16.945818901 CET	50764	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:16.951021910 CET	2969	50764	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:16.951092958 CET	50764	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:16.952177048 CET	50764	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:16.957250118 CET	2969	50764	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:16.957458973 CET	50764	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:16.962436914 CET	2969	50764	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:17.722719908 CET	2969	50764	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:17.723293066 CET	50764	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:17.723294020 CET	50764	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:17.725615025 CET	50766	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:17.730798960 CET	2969	50766	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:17.731276989 CET	50766	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:17.734138966 CET	50766	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:17.739623070 CET	2969	50766	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:17.739983082 CET	50766	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:17.745594025 CET	2969	50766	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:18.512695074 CET	2969	50766	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:18.513411045 CET	50766	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:18.513411999 CET	50766	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:18.515706062 CET	50768	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:18.520929098 CET	2969	50768	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:18.521450996 CET	50768	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:18.523612022 CET	50768	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:18.528765917 CET	2969	50768	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:18.529230118 CET	50768	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:18.534554005 CET	2969	50768	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:19.207804918 CET	2969	50768	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:19.208249092 CET	50768	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:19.208376884 CET	50768	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:19.210530996 CET	50770	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:19.215909958 CET	2969	50770	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:19.216418982 CET	50770	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:19.218970060 CET	50770	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:19.224261999 CET	2969	50770	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:19.224590063 CET	50770	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:19.230076075 CET	2969	50770	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:19.985181093 CET	2969	50770	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:19.985727072 CET	50770	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:19.985837936 CET	50770	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:19.988703012 CET	50772	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:19.994029045 CET	2969	50772	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:19.994415045 CET	50772	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:19.996794939 CET	50772	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:20.002239943 CET	2969	50772	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:20.002607107 CET	50772	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:20.008097887 CET	2969	50772	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:20.991578102 CET	2969	50772	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:20.992088079 CET	50772	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:20.992225885 CET	50772	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:20.994832039 CET	50774	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:21.001081944 CET	2969	50774	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:21.001502037 CET	50774	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:21.004072905 CET	50774	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:21.009705067 CET	2969	50774	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:21.009892941 CET	50774	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:21.015537024 CET	2969	50774	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:21.756439924 CET	2969	50774	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:21.757149935 CET	50774	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:21.757149935 CET	50774	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:21.760020018 CET	50776	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:21.765613079 CET	2969	50776	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:21.765997887 CET	50776	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:21.768728971 CET	50776	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:21.774044037 CET	2969	50776	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:21.774271965 CET	50776	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:21.779655933 CET	2969	50776	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:22.488414049 CET	2969	50776	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:22.489068031 CET	50776	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:22.489068031 CET	50776	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:22.491446972 CET	50778	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:22.790035963 CET	2969	50778	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:22.790442944 CET	50778	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:22.792958975 CET	50778	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:22.798504114 CET	2969	50778	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:22.798784018 CET	50778	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:22.804200888 CET	2969	50778	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:23.531121016 CET	2969	50778	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:23.531562090 CET	50778	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:23.531897068 CET	50778	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:23.534477949 CET	50780	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:23.540384054 CET	2969	50780	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:23.540646076 CET	50780	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:23.543474913 CET	50780	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:23.549226999 CET	2969	50780	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:23.549586058 CET	50780	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:23.555139065 CET	2969	50780	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:23.796189070 CET	42836	443	192.168.2.23	91.189.91.43
Jan 9, 2025 20:33:24.328468084 CET	2969	50780	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:24.329140902 CET	50780	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:24.329294920 CET	50780	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:24.331831932 CET	50782	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:24.337120056 CET	2969	50782	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:24.337372065 CET	50782	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:24.339775085 CET	50782	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:24.345031023 CET	2969	50782	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:24.345266104 CET	50782	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:24.351072073 CET	2969	50782	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:25.029650927 CET	2969	50782	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:25.029975891 CET	50782	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:25.030107975 CET	50782	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:25.032043934 CET	50784	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:25.037122011 CET	2969	50784	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:25.037405968 CET	50784	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:25.039423943 CET	50784	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:25.044553041 CET	2969	50784	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:25.044820070 CET	50784	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:25.050385952 CET	2969	50784	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:25.740963936 CET	2969	50784	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:25.741628885 CET	50784	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:25.741630077 CET	50784	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:25.744666100 CET	50786	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:25.750416994 CET	2969	50786	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:25.750663996 CET	50786	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:25.753501892 CET	50786	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:25.758865118 CET	2969	50786	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:25.759401083 CET	50786	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:25.764821053 CET	2969	50786	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:26.409904957 CET	2969	50786	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:26.410321951 CET	50786	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:26.410321951 CET	50786	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:26.413383007 CET	50788	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:26.418723106 CET	2969	50788	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:26.418831110 CET	50788	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:26.421396017 CET	50788	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:26.426805019 CET	2969	50788	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:26.427002907 CET	50788	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:26.432452917 CET	2969	50788	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:27.095519066 CET	2969	50788	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:27.096162081 CET	50788	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:27.096162081 CET	50788	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:27.098516941 CET	50790	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:27.103709936 CET	2969	50790	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:27.104170084 CET	50790	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:27.106456995 CET	50790	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:27.111543894 CET	2969	50790	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:27.111928940 CET	50790	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:27.117237091 CET	2969	50790	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:27.891794920 CET	42516	80	192.168.2.23	109.202.202.202
Jan 9, 2025 20:33:27.940862894 CET	2969	50790	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:27.941317081 CET	50790	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:27.941318035 CET	50790	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:27.943300962 CET	50792	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:27.948851109 CET	2969	50792	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:27.949184895 CET	50792	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:27.951216936 CET	50792	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:27.956753016 CET	2969	50792	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:27.957163095 CET	50792	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:27.962779045 CET	2969	50792	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:28.682580948 CET	2969	50792	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:28.682934046 CET	50792	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:28.682934046 CET	50792	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:28.684617996 CET	50794	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:28.689719915 CET	2969	50794	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:28.690001011 CET	50794	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:28.692286968 CET	50794	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:28.697745085 CET	2969	50794	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:28.698246956 CET	50794	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:28.703463078 CET	2969	50794	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:29.371505976 CET	2969	50794	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:29.371786118 CET	50794	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:29.371786118 CET	50794	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:29.373050928 CET	50796	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:29.378042936 CET	2969	50796	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:29.378123999 CET	50796	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:29.379825115 CET	50796	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:29.384702921 CET	2969	50796	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:29.384830952 CET	50796	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:29.389668941 CET	2969	50796	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:30.111958027 CET	2969	50796	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:30.112291098 CET	50796	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:30.112371922 CET	50796	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:30.114394903 CET	50798	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:30.119424105 CET	2969	50798	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:30.119652033 CET	50798	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:30.122111082 CET	50798	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:30.127382994 CET	2969	50798	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:30.127799988 CET	50798	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:30.133012056 CET	2969	50798	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:30.785093069 CET	2969	50798	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:30.785356045 CET	50798	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:30.785420895 CET	50798	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:30.787725925 CET	50800	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:30.795479059 CET	2969	50800	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:30.795562983 CET	50800	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:30.797636032 CET	50800	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:30.803013086 CET	2969	50800	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:30.803378105 CET	50800	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:30.808614016 CET	2969	50800	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:31.652081013 CET	2969	50800	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:31.652151108 CET	2969	50800	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:31.652184963 CET	2969	50800	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:31.652226925 CET	50800	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:31.652228117 CET	50800	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:31.652228117 CET	50800	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:31.652295113 CET	50800	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:31.654020071 CET	50802	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:31.659466982 CET	2969	50802	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:31.659514904 CET	50802	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:31.660551071 CET	50802	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:31.665530920 CET	2969	50802	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:31.665627956 CET	50802	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:31.670569897 CET	2969	50802	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:32.353276968 CET	2969	50802	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:32.353416920 CET	50802	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:32.353502035 CET	50802	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:32.355495930 CET	50804	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:32.360512972 CET	2969	50804	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:32.360873938 CET	50804	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:32.363363981 CET	50804	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:32.368469954 CET	2969	50804	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:32.368793011 CET	50804	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:32.373716116 CET	2969	50804	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:33.054889917 CET	2969	50804	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:33.055614948 CET	50804	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:33.055614948 CET	50804	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:33.058139086 CET	50806	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:33.063457966 CET	2969	50806	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:33.063983917 CET	50806	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:33.066365004 CET	50806	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:33.071584940 CET	2969	50806	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:33.071939945 CET	50806	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:33.077112913 CET	2969	50806	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:33.732876062 CET	2969	50806	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:33.733371973 CET	50806	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:33.733371973 CET	50806	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:33.736022949 CET	50808	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:33.741578102 CET	2969	50808	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:33.741957903 CET	50808	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:33.744555950 CET	50808	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:33.750047922 CET	2969	50808	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:33.750277042 CET	50808	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:33.755542040 CET	2969	50808	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:34.435338020 CET	2969	50808	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:34.435795069 CET	50808	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:34.435879946 CET	50808	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:34.438071012 CET	50810	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:34.443084955 CET	2969	50810	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:34.443440914 CET	50810	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:34.445626020 CET	50810	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:34.451093912 CET	2969	50810	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:34.451446056 CET	50810	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:34.456768036 CET	2969	50810	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:35.123590946 CET	2969	50810	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:35.124119043 CET	50810	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:35.124119043 CET	50810	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:35.126014948 CET	50812	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:35.131068945 CET	2969	50812	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:35.131366968 CET	50812	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:35.132945061 CET	50812	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:35.138763905 CET	2969	50812	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:35.138851881 CET	50812	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:35.144757986 CET	2969	50812	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:35.915916920 CET	2969	50812	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:35.916544914 CET	50812	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:35.916544914 CET	50812	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:35.918399096 CET	50814	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:35.923765898 CET	2969	50814	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:35.924093962 CET	50814	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:35.926141977 CET	50814	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:35.931370020 CET	2969	50814	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:35.931699038 CET	50814	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:35.936788082 CET	2969	50814	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:36.626400948 CET	2969	50814	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:36.626744032 CET	50814	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:36.626744032 CET	50814	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:36.628501892 CET	50816	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:36.633771896 CET	2969	50816	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:36.633924961 CET	50816	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:36.635660887 CET	50816	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:36.640822887 CET	2969	50816	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:36.641261101 CET	50816	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:36.646509886 CET	2969	50816	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:37.299828053 CET	2969	50816	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:37.300345898 CET	50816	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:37.300345898 CET	50816	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:37.302639961 CET	50818	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:37.308717966 CET	2969	50818	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:37.309160948 CET	50818	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:37.311177969 CET	50818	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:37.316951990 CET	2969	50818	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:37.317322969 CET	50818	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:37.322612047 CET	2969	50818	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:37.997582912 CET	2969	50818	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:37.998147011 CET	50818	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:37.998147011 CET	50818	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:38.000278950 CET	50820	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:38.005927086 CET	2969	50820	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:38.006459951 CET	50820	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:38.008497000 CET	50820	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:38.013891935 CET	2969	50820	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:38.014199972 CET	50820	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:38.019674063 CET	2969	50820	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:38.699707985 CET	2969	50820	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:38.700429916 CET	50820	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:38.700429916 CET	50820	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:38.703269005 CET	50822	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:38.708898067 CET	2969	50822	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:38.709189892 CET	50822	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:38.711085081 CET	50822	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:38.716506958 CET	2969	50822	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:38.717021942 CET	50822	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:38.722661972 CET	2969	50822	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:39.388437986 CET	2969	50822	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:39.389141083 CET	50822	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:39.389141083 CET	50822	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:39.391974926 CET	50824	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:39.397510052 CET	2969	50824	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:39.397730112 CET	50824	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:39.401146889 CET	50824	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:39.406584024 CET	2969	50824	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:39.407078981 CET	50824	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:39.413036108 CET	2969	50824	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:40.092120886 CET	2969	50824	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:40.092809916 CET	50824	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:40.092809916 CET	50824	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:40.095626116 CET	50826	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:40.101332903 CET	2969	50826	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:40.102015972 CET	50826	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:40.105500937 CET	50826	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:40.110893965 CET	2969	50826	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:40.111378908 CET	50826	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:40.116878986 CET	2969	50826	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:40.818023920 CET	2969	50826	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:40.818507910 CET	50826	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:40.818588018 CET	50826	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:40.821836948 CET	50828	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:40.827389002 CET	2969	50828	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:40.827908993 CET	50828	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:40.830957890 CET	50828	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:40.836803913 CET	2969	50828	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:40.837184906 CET	50828	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:40.843120098 CET	2969	50828	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:50.840135098 CET	50828	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:51.048326015 CET	50828	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:51.260360956 CET	50828	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:51.393378973 CET	2969	50828	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:51.393429995 CET	2969	50828	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:51.393457890 CET	2969	50828	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:51.599231005 CET	2969	50828	185.196.9.234	192.168.2.23
Jan 9, 2025 20:33:51.599543095 CET	50828	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:33:52.464030981 CET	43928	443	192.168.2.23	91.189.91.42
Jan 9, 2025 20:34:51.631580114 CET	50828	2969	192.168.2.23	185.196.9.234
Jan 9, 2025 20:34:51.637255907 CET	2969	50828	185.196.9.234	192.168.2.23
Jan 9, 2025 20:34:51.868674994 CET	2969	50828	185.196.9.234	192.168.2.23
Jan 9, 2025 20:34:51.869131088 CET	50828	2969	192.168.2.23	185.196.9.234

System Behavior

Analysis Process: fenty.arm5.elf PID: 6217, Parent PID: 6136

General

Start time (UTC):	19:32:52
Start date (UTC):	09/01/2025
Path:	/tmp/fenty.arm5.elf
Arguments:	/tmp/fenty.arm5.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	19:32:52
Start date (UTC):	09/01/2025
Path:	/tmp/fenty.arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report fenty.arm5.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: fenty.arm5.elf PID: 6217, Parent PID: 6136

General

Chronological Activities

Analysis Process: fenty.arm5.elf PID: 6221, Parent PID: 6217

General

Chronological Activities

Linux Analysis Report
fenty.arm5.elf