Edit tour

Linux Analysis Report
arm.elf

Overview

General Information

Sample name:	arm.elf
Analysis ID:	1612190
MD5:	d9bb22ab04a9f0b899bfc31666e5c708
SHA1:	17f5bb279502b935ce6b6e33da5fd6a519a0501f
SHA256:	b53bd7a2dbb92cbe3dd8d3ed17f530db13dcf7b2b5e1bff1c13f6c6570707d24
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Sample contains only a LOAD segment without any section mappings

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1612190
Start date and time:	2025-02-11 16:10:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	arm.elf
Detection:	MAL
Classification:	mal72.spre.troj.linELF@0/0@52/0

Runtime Messages

Command:	/tmp/arm.elf
PID:	5709
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	The Peoples Bank of China.
Standard Error:

Process Tree

system is lnxubuntu20

arm.elf (PID: 5709, Parent: 5636, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm.elf

arm.elf New Fork (PID: 5711, Parent: 5709)

arm.elf New Fork (PID: 5713, Parent: 5711)

arm.elf New Fork (PID: 5715, Parent: 5711)

arm.elf New Fork (PID: 5716, Parent: 5711)

xfce4-session New Fork (PID: 5741, Parent: 3074)

gdm3 New Fork (PID: 5742, Parent: 1333)

Default (PID: 5742, Parent: 1333, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5748, Parent: 1333)

Default (PID: 5748, Parent: 1333, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

xfce4-session New Fork (PID: 5749, Parent: 3074)

xfce4-session New Fork (PID: 5752, Parent: 3074)

xfce4-session New Fork (PID: 5753, Parent: 3074)

xfdesktop (PID: 5753, Parent: 3074, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 2975cc77d-4424-4c3b-abac-4708c6227ebe

xfce4-session New Fork (PID: 5755, Parent: 3074)

xfce4-panel (PID: 5755, Parent: 3074, MD5: a15b657c7d54ac1385f1f15004ea6784) Arguments: xfce4-panel --display :1.0 --sm-client-id 2231df6a5-9489-4681-813c-95be59ba41ad

xfce4-session New Fork (PID: 5757, Parent: 3074)

xfwm4 (PID: 5757, Parent: 3074, MD5: 59defa3c00cc30d85ed77b738d55e9da) Arguments: xfwm4 --display :1.0 --sm-client-id 25b39293a-fee6-4e14-94fe-6ac0d9644afd

xfce4-session New Fork (PID: 5759, Parent: 3074)

xfdesktop (PID: 5759, Parent: 3074, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 2975cc77d-4424-4c3b-abac-4708c6227ebe

xfce4-session New Fork (PID: 5760, Parent: 3074)

xfce4-session New Fork (PID: 5761, Parent: 3074)

xfce4-panel (PID: 5761, Parent: 3074, MD5: a15b657c7d54ac1385f1f15004ea6784) Arguments: xfce4-panel --display :1.0 --sm-client-id 2231df6a5-9489-4681-813c-95be59ba41ad

xfce4-session New Fork (PID: 5762, Parent: 3074)

xfce4-session New Fork (PID: 5763, Parent: 3074)

xfwm4 (PID: 5763, Parent: 3074, MD5: 59defa3c00cc30d85ed77b738d55e9da) Arguments: xfwm4 --display :1.0 --sm-client-id 25b39293a-fee6-4e14-94fe-6ac0d9644afd

xfce4-session New Fork (PID: 5765, Parent: 3074)

xfdesktop (PID: 5765, Parent: 3074, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 2975cc77d-4424-4c3b-abac-4708c6227ebe

systemd New Fork (PID: 5768, Parent: 1)

systemd-user-runtime-dir (PID: 5768, Parent: 1, MD5: d55f4b0847f88131dbcfb07435178e54) Arguments: /lib/systemd/systemd-user-runtime-dir stop 127

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
5713.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5713.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5715.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5715.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5709.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5709.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Click to see the 1 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: arm.elf	Virustotal: Detection: 32%			Perma Link
Source: arm.elf	ReversingLabs: Detection: 21%

Networking

Sends malformed DNS queries

Source: global traffic	DNS traffic detected: malformed DNS query: mykittler.ru. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: kittler.ru. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: kittlez.ru. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: cuttiecats.ru. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: thekittler.ru. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: qittler.ru. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: polizei.su. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: cat-are-here.ru. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: gokittler.ru. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: newkittler.ru. [malformed]

Source: global traffic

TCP traffic: 192.168.2.15:44984 -> 185.93.89.106:34411

Source: /tmp/arm.elf (PID: 5709)

Socket: 127.0.0.1:13301

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 51.168.247.220
Source: unknown	TCP traffic detected without corresponding DNS query: 62.209.219.207
Source: unknown	TCP traffic detected without corresponding DNS query: 51.168.247.220
Source: unknown	TCP traffic detected without corresponding DNS query: 62.209.219.207
Source: unknown	TCP traffic detected without corresponding DNS query: 17.235.230.54
Source: unknown	TCP traffic detected without corresponding DNS query: 89.147.218.37
Source: unknown	TCP traffic detected without corresponding DNS query: 17.235.230.54
Source: unknown	TCP traffic detected without corresponding DNS query: 67.220.114.32
Source: unknown	TCP traffic detected without corresponding DNS query: 89.147.218.37
Source: unknown	TCP traffic detected without corresponding DNS query: 67.220.114.32
Source: unknown	TCP traffic detected without corresponding DNS query: 166.242.235.68
Source: unknown	TCP traffic detected without corresponding DNS query: 166.242.235.68
Source: unknown	TCP traffic detected without corresponding DNS query: 68.175.143.91
Source: unknown	TCP traffic detected without corresponding DNS query: 50.32.220.208
Source: unknown	TCP traffic detected without corresponding DNS query: 68.175.143.91
Source: unknown	TCP traffic detected without corresponding DNS query: 50.32.220.208
Source: unknown	TCP traffic detected without corresponding DNS query: 196.186.19.74
Source: unknown	TCP traffic detected without corresponding DNS query: 196.186.19.74
Source: unknown	TCP traffic detected without corresponding DNS query: 141.121.35.201
Source: unknown	TCP traffic detected without corresponding DNS query: 141.121.35.201
Source: unknown	TCP traffic detected without corresponding DNS query: 164.23.51.133
Source: unknown	TCP traffic detected without corresponding DNS query: 164.23.51.133
Source: unknown	TCP traffic detected without corresponding DNS query: 45.113.140.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.113.140.94
Source: unknown	TCP traffic detected without corresponding DNS query: 16.79.84.77
Source: unknown	TCP traffic detected without corresponding DNS query: 16.79.84.77
Source: unknown	TCP traffic detected without corresponding DNS query: 197.173.23.152
Source: unknown	TCP traffic detected without corresponding DNS query: 197.173.23.152
Source: unknown	TCP traffic detected without corresponding DNS query: 148.233.93.10
Source: unknown	TCP traffic detected without corresponding DNS query: 148.233.93.10
Source: unknown	TCP traffic detected without corresponding DNS query: 12.242.217.170
Source: unknown	TCP traffic detected without corresponding DNS query: 12.242.217.170
Source: unknown	TCP traffic detected without corresponding DNS query: 126.123.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 126.123.149.89
Source: unknown	TCP traffic detected without corresponding DNS query: 15.170.107.51
Source: unknown	TCP traffic detected without corresponding DNS query: 15.170.107.51
Source: unknown	TCP traffic detected without corresponding DNS query: 131.61.237.29
Source: unknown	TCP traffic detected without corresponding DNS query: 131.61.237.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.129.156.39
Source: unknown	TCP traffic detected without corresponding DNS query: 23.129.156.39
Source: unknown	TCP traffic detected without corresponding DNS query: 157.147.83.110
Source: unknown	TCP traffic detected without corresponding DNS query: 157.147.83.110
Source: unknown	TCP traffic detected without corresponding DNS query: 129.35.125.68
Source: unknown	TCP traffic detected without corresponding DNS query: 117.200.79.202
Source: unknown	TCP traffic detected without corresponding DNS query: 129.35.125.68
Source: unknown	TCP traffic detected without corresponding DNS query: 117.200.79.202
Source: unknown	TCP traffic detected without corresponding DNS query: 201.241.232.73
Source: unknown	TCP traffic detected without corresponding DNS query: 94.44.131.22
Source: unknown	TCP traffic detected without corresponding DNS query: 201.241.232.73
Source: unknown	TCP traffic detected without corresponding DNS query: 94.44.131.22

Source: global traffic	DNS traffic detected: DNS query: gokittler.ru
Source: global traffic	DNS traffic detected: DNS query: cuttiecats.ru
Source: global traffic	DNS traffic detected: DNS query: mykittler.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: thekittler.ru
Source: global traffic	DNS traffic detected: DNS query: kittler.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: cats-master.ru
Source: global traffic	DNS traffic detected: DNS query: kittlez.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: cuttiecats.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: cat-are-here.ru
Source: global traffic	DNS traffic detected: DNS query: thekittler.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: qittler.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: kittlerer.ru
Source: global traffic	DNS traffic detected: DNS query: polizei.su. [malformed]
Source: global traffic	DNS traffic detected: DNS query: cat-are-here.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: gokittler.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: newkittler.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: newkittler.ru

Source: arm.elf, 5709.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp, arm.elf, 5713.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp, arm.elf, 5715.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp	String found in binary or memory: http:///curl.sh
Source: arm.elf, 5709.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp, arm.elf, 5713.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp, arm.elf, 5715.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp	String found in binary or memory: http:///wget.sh

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 723, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 724, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 888, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 1496, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 1585, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 1617, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3052, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3055, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3074, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3201, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3220, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3222, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3234, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3235, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3241, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3246, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3273, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3275, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3278, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3292, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3310, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5694, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5713, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5715, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5741, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5749, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5752, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5753, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5754, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5755, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5756, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5757, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5758, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5759, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5760, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5761, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5762, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5763, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5764, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5765, result: successful	Jump to behavior

Source: LOAD without section mappings

Program segment: 0x8000

Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 723, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 724, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 888, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 1496, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 1585, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 1617, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3052, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3055, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3074, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3201, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3220, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3222, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3234, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3235, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3241, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3246, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3273, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3275, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3278, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3292, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 3310, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5694, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5713, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5715, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5741, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5749, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5752, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5753, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5754, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5755, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5756, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5757, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5758, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5759, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5760, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5761, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5762, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5763, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5764, result: successful	Jump to behavior
Source: /tmp/arm.elf (PID: 5716)	SIGKILL sent: pid: 5765, result: successful	Jump to behavior

Source: classification engine

Classification label: mal72.spre.troj.linELF@0/0@52/0

Source: arm.elf	Submission file: segment LOAD with 7.8832 entropy (max. 8.0)
Source: arm.elf	Submission file: segment LOAD with 7.9721 entropy (max. 8.0)

Source: /tmp/arm.elf (PID: 5709)

Queries kernel information via 'uname':

Jump to behavior

Source: arm.elf, 5709.1.00007ffd863bc000.00007ffd863dd000.rw-.sdmp, arm.elf, 5713.1.00007ffd863bc000.00007ffd863dd000.rw-.sdmp, arm.elf, 5715.1.00007ffd863bc000.00007ffd863dd000.rw-.sdmp	Binary or memory string: Xx86_64/usr/bin/qemu-arm/tmp/arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm.elf
Source: arm.elf, 5715.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp	Binary or memory string: vmware
Source: arm.elf, 5709.1.000055e5467eb000.000055e546919000.rw-.sdmp, arm.elf, 5713.1.000055e5467eb000.000055e546919000.rw-.sdmp, arm.elf, 5715.1.000055e5467eb000.000055e546919000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: arm.elf, 5715.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp	Binary or memory string: vmware123
Source: arm.elf, 5715.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp	Binary or memory string: / nE7jA%5mmicrobusinessPASSWORDmeinsmcms500adslnadamgiraff666666zoomadslsuperadminIs@dminikwbalpineasantepuconexantaquariotinitsunamivertex25ektks123inflectionip20anicuscADMINpermitpldtadminonexantdvr2580222Win1doW$true5432112341234JVC3500/24sitecom46ironport88888888uClinuxvolition2800tslinuxsecurityatlantis888888nCwMnJVGagbaby00000000openelec1111111kont2004rpitc123123696969362729atc456hp.comcycl3R0cks!letacla000000nosoup4u11111111Gin51mvf3mg3500merlin99999999admin1anni201322222mlusrlogin3333333adminpldtbbsd-clientchangeme2support123aerohiveadmin00vmware123utstartl789l3tm31nseiko2005tivonpw,ba23422222222admintrupt1789admdarkcusadminhighspeedascendMenarasysAdmin33333oracleanicust3333wbox123attackAscendAitbISP4eCiGadmin@mymifi2222222dPZb4GJTu9ROOMeins1988321piloucomcastsetupZmqVfoSIP333333michelangeloCOadmin123Zntslqblendervt100admin_1pfsensehellotest1my_DEMARCjvswitchezdvr7ujMko0root/ADMIN/adminlvjhadminlvjh1232010vstaxmhdpicruntop10qwertyQwestM0demqweasdzxguest123h2014071TANDBERGWprootarkeiachangemenowf00b@rarticawww9311supersurtiwkbadmintesthuigu309UsernetscreenpitaZz@23495859Root1password123fidel123annie2016asdfghdottietwe8ehomebatman123hackedwelcomeyellowD13hh[china123p@ssw0rdjordanhackmewagodasdec1patrickgforgeEminemspidermansparkypassword1shadowgatewaydiamondprincessflowerchelsearichardFootballpornsexycamarofalconwhorebigdogChongqingcuntmartin12121212bitchcheeseHustonsecretpassword123456789Metallicacowboy1999654321slipknotstarwarsCharlie1997daddyRootdragonhustonfuckmepussytrustno1cowboysfootballsmcadminsysadmvmwareprofensegamezlrkr0x123qwesuperuserIntraStackAsantecraftcrftpwfriendrootmeP@55w0rd!debugrainCisconsrootinformixmediatorqwe123db2fenc1ibmdb2forgotvideoinfobloxdb2inst1nagiosxiiclocktimelyenablediagdraytekdbadminsq!us3rglftpddiagdangerapcAlphanetworkswrgg15_di524adminHWapacheabcwebserverapache123arpwatchavinashaspbackupadminazzakhalelbackuppukcabasteriskbackupscmhealthbadservercactielliebackup1234cloudcbscbs123billsupermenbenutzerpasswortftp1234annie2013annie2015annie2012annie2014jvcepicrouter
Source: arm.elf, 5709.1.000055e5467eb000.000055e546919000.rw-.sdmp, arm.elf, 5713.1.000055e5467eb000.000055e546919000.rw-.sdmp, arm.elf, 5715.1.000055e5467eb000.000055e546919000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: arm.elf, 5709.1.00007ffd863bc000.00007ffd863dd000.rw-.sdmp, arm.elf, 5713.1.00007ffd863bc000.00007ffd863dd000.rw-.sdmp, arm.elf, 5715.1.00007ffd863bc000.00007ffd863dd000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 5713.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5715.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5709.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 5713.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5715.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5709.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Obfuscated Files or Information	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
arm.elf	33%	Virustotal		Browse
arm.elf	22%	ReversingLabs	Linux.Trojan.Svirtu

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
cat-are-here.ru	185.93.89.106	true	false	high
cuttiecats.ru	185.93.89.106	true	false	high
thekittler.ru	185.93.89.106	true	false	high
newkittler.ru	185.93.89.106	true	false	high
cats-master.ru	185.93.89.106	true	false	high
kittlerer.ru	185.93.89.106	true	false	high
gokittler.ru	185.93.89.106	true	false	high
qittler.ru. [malformed]	unknown	unknown	false	high
gokittler.ru. [malformed]	unknown	unknown	false	high
kittler.ru. [malformed]	unknown	unknown	false	high
thekittler.ru. [malformed]	unknown	unknown	false	high
newkittler.ru. [malformed]	unknown	unknown	false	high
cuttiecats.ru. [malformed]	unknown	unknown	false	high
cat-are-here.ru. [malformed]	unknown	unknown	false	high
mykittler.ru. [malformed]	unknown	unknown	false	high
polizei.su. [malformed]	unknown	unknown	false	high
kittlez.ru. [malformed]	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http:///wget.sh	arm.elf, 5709.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp, arm.elf, 5713.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp, arm.elf, 5715.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp	false		high
http:///curl.sh	arm.elf, 5709.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp, arm.elf, 5713.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp, arm.elf, 5715.1.00007ff9d8017000.00007ff9d802f000.r-x.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
131.61.237.29	unknown	United States	385	AFCONC-BLOCK1-ASUS	false
89.147.218.37	unknown	Azerbaijan	39397	AZ-STARNET-ASAZ	false
17.235.230.54	unknown	United States	714	APPLE-ENGINEERINGUS	false
51.168.247.220	unknown	United States	2686	ATGS-MMD-ASUS	false
164.23.51.133	unknown	Germany	29355	KCELL-ASKZ	false
196.186.19.74	unknown	Tunisia	5438	ATI-TN	false
166.242.235.68	unknown	United States	6614	USCC-ASNUS	false
16.79.84.77	unknown	United States	unknown	unknown	false
126.123.149.89	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
67.220.114.32	unknown	United States	20141	QTS-SUW1-ATL1US	false
50.32.220.208	unknown	United States	5650	FRONTIER-FRTRUS	false
94.44.131.22	unknown	Hungary	21334	ASN-VODAFONE-HU	false
195.199.4.200	unknown	Hungary	1955	HBONE-ASHUNGARNETHU	false
185.93.89.106	cat-are-here.ru	United Kingdom	200861	TS-EMEA-ASNGB	false
23.129.156.39	unknown	Reserved	395777	AUBFIBERUS	false
68.175.143.91	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
15.170.107.51	unknown	United States	71	HP-INTERNET-ASUS	false
129.35.125.68	unknown	United States	14926	IBMCCH-MILUS	false
148.233.93.10	unknown	Mexico	8151	UninetSAdeCVMX	false
45.113.140.94	unknown	Hong Kong	133485	GAMELOFTLIMITED-AS-APGameloftLimitedHK	false
157.147.83.110	unknown	Japan	2527	SO-NETSo-netEntertainmentCorporationJP	false
141.121.35.201	unknown	United States	6	BULL-HNUS	false
197.173.23.152	unknown	South Africa	37168	CELL-CZA	false
12.242.217.170	unknown	United States	7018	ATT-INTERNET4US	false
201.241.232.73	unknown	Chile	22047	VTRBANDAANCHASACL	false
117.200.79.202	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
91.11.162.17	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
62.209.219.207	unknown	Czech Republic	5588	GTSCEGTSCentralEuropeAntelGermanyCZ	false
101.72.83.22	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.93.89.106	dlr.mips.elf	Get hash	malicious	Mirai	Browse	/mips
	dlr.arm6.elf	Get hash	malicious	Mirai	Browse	/arm6
	dlr.arm7.elf	Get hash	malicious	Mirai	Browse	/arm7

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cat-are-here.ru	arm4.elf	Get hash	malicious	Mirai	Browse	185.93.89.106
	mips.elf	Get hash	malicious	Mirai	Browse	185.93.89.106
	arm7.elf	Get hash	malicious	Mirai	Browse	185.93.89.106
thekittler.ru	arm7.elf	Get hash	malicious	Mirai	Browse	185.93.89.106
thekittler.ru	rep.spc.elf	Get hash	malicious	Unknown	Browse	156.229.232.99
newkittler.ru	mpsl.elf	Get hash	malicious	Mirai	Browse	185.93.89.106
newkittler.ru	rep.m68k.elf	Get hash	malicious	Unknown	Browse	156.229.232.99
cuttiecats.ru	mpsl.elf	Get hash	malicious	Mirai	Browse	185.93.89.106
	rep.m68k.elf	Get hash	malicious	Mirai	Browse	185.93.89.106
	mips.elf	Get hash	malicious	Mirai	Browse	185.93.89.106
	rep.arm5.elf	Get hash	malicious	Unknown	Browse	156.229.232.99

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATGS-MMD-ASUS	mpsl.elf	Get hash	malicious	Mirai	Browse	32.166.81.167
	arm7.elf	Get hash	malicious	Mirai	Browse	33.193.91.1
	https://files.fm/f/wpd3hsuh55?share_email_id=15c922d&share_email_skip_notify=true	Get hash	malicious	Unknown	Browse	34.1.230.247
	https://vc.ru/u/4322747-sasha-v-it/1715355-aktivaciya-windows-10-i-11-cherez-komandnuyu-stroku	Get hash	malicious	Unknown	Browse	51.250.75.211
	185.93.89.101-x86-2025-02-11T10_20_14.elf	Get hash	malicious	Mirai	Browse	33.78.219.110
	185.93.89.101-mips-2025-02-11T10_20_14.elf	Get hash	malicious	Mirai	Browse	56.72.87.202
	FacturaVisorCGEelectricidad.msi	Get hash	malicious	Unknown	Browse	34.54.45.198
	px4Y74kUj2.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.160.144.191
	https://hopp.bio/universeglobalcent	Get hash	malicious	Unknown	Browse	34.149.87.45
	https://secure----sso---robinhod-com--authh.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	34.128.128.0
KCELL-ASKZ	arm5.elf	Get hash	malicious	Unknown	Browse	164.33.39.118
	nklppc.elf	Get hash	malicious	Unknown	Browse	164.28.62.70
	botnet.arm5.elf	Get hash	malicious	Mirai, Moobot	Browse	164.18.31.71
	botx.mips.elf	Get hash	malicious	Mirai	Browse	2.76.32.129
	nabmpsl.elf	Get hash	malicious	Unknown	Browse	164.25.149.167
	splmips.elf	Get hash	malicious	Unknown	Browse	2.72.175.189
	jklmpsl.elf	Get hash	malicious	Unknown	Browse	2.78.249.140
	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	2.76.79.132
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	164.0.118.84
	sora.spc.elf	Get hash	malicious	Mirai	Browse	164.16.91.65
AFCONC-BLOCK1-ASUS	splmpsl.elf	Get hash	malicious	Unknown	Browse	143.150.52.190
	nabm68k.elf	Get hash	malicious	Unknown	Browse	129.141.79.214
	nabx86.elf	Get hash	malicious	Unknown	Browse	132.50.152.165
	splx86.elf	Get hash	malicious	Unknown	Browse	143.144.125.93
	splarm5.elf	Get hash	malicious	Unknown	Browse	143.153.72.22
	nabspc.elf	Get hash	malicious	Unknown	Browse	134.18.156.246
	nklsh4.elf	Get hash	malicious	Unknown	Browse	132.19.11.6
	splmips.elf	Get hash	malicious	Unknown	Browse	133.180.242.222
	nabarm5.elf	Get hash	malicious	Unknown	Browse	134.128.31.37
	splarm.elf	Get hash	malicious	Unknown	Browse	133.161.179.192
AZ-STARNET-ASAZ	nshppc.elf	Get hash	malicious	Mirai	Browse	89.147.254.207
	jade.ppc.elf	Get hash	malicious	Mirai	Browse	85.132.15.216
	DTqB84IHyf.elf	Get hash	malicious	Mirai	Browse	85.132.15.216
	7vbrDg2AF5.elf	Get hash	malicious	Mirai	Browse	85.132.15.214
	fdf2SzzeIg.elf	Get hash	malicious	Mirai	Browse	85.132.15.203
	NmgshxQv7g.elf	Get hash	malicious	Mirai	Browse	89.147.254.209
	yakov.arm-20220901-1344.elf	Get hash	malicious	Mirai	Browse	89.147.254.219
	lGXq9Y3KxS	Get hash	malicious	Mirai	Browse	89.147.254.229
	J4GJcoo8oh	Get hash	malicious	Mirai	Browse	85.132.15.211
	x86_64-20220428-1001	Get hash	malicious	Mirai	Browse	85.132.15.206

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, no section header
Entropy (8bit):	7.9701123662963935
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	arm.elf
File size:	40'976 bytes
MD5:	d9bb22ab04a9f0b899bfc31666e5c708
SHA1:	17f5bb279502b935ce6b6e33da5fd6a519a0501f
SHA256:	b53bd7a2dbb92cbe3dd8d3ed17f530db13dcf7b2b5e1bff1c13f6c6570707d24
SHA512:	273daad1bc001b626e8fa0d90e23638bc3253c18a554360482c57447b6a86942f1bab4930b19a13f6475502e926a616262b1bab51f5b67d5992a7017b8d56bf9
SSDEEP:	768:A7wkhDz1oPTvHoumEp+W59zSrcDiO+NzeubPD3UGOi:2zOPTvIuzAWnzSrcb+YOPLV
TLSH:	B203E1A30A8766F1C27C14F2C54B988BAAD919F470FE3531231440E7B3C56A1B0FEA4A
File Content Preview:	.ELF...a..........(.....t...4...........4. ...(.........................`(..........................#...#...........Q.td............................\...sfga.........x...x......T..........?.E.h;.}...^...........u7/.H......3..`..c...._...T.t..E..J.4....\|R3.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x38d74
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8000	0x8000	0x1000	0x22860	7.8832	0x6	RW	0x8000
LOAD	0x0	0x30000	0x30000	0x9f23	0x9f23	7.9721	0x5	R E	0x8000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 477
• 34411 undefined
• 53 (DNS)
• 23 (Telnet)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 11, 2025 16:11:47.899224043 CET	48334	23	192.168.2.15	51.168.247.220
Feb 11, 2025 16:11:47.903420925 CET	45944	23	192.168.2.15	62.209.219.207
Feb 11, 2025 16:11:47.904021978 CET	23	48334	51.168.247.220	192.168.2.15
Feb 11, 2025 16:11:47.904077053 CET	48334	23	192.168.2.15	51.168.247.220
Feb 11, 2025 16:11:47.908274889 CET	23	45944	62.209.219.207	192.168.2.15
Feb 11, 2025 16:11:47.908664942 CET	45944	23	192.168.2.15	62.209.219.207
Feb 11, 2025 16:11:47.909636974 CET	53658	23	192.168.2.15	17.235.230.54
Feb 11, 2025 16:11:47.914433002 CET	23	53658	17.235.230.54	192.168.2.15
Feb 11, 2025 16:11:47.914597988 CET	53206	23	192.168.2.15	89.147.218.37
Feb 11, 2025 16:11:47.914623976 CET	53658	23	192.168.2.15	17.235.230.54
Feb 11, 2025 16:11:47.919028044 CET	49282	23	192.168.2.15	67.220.114.32
Feb 11, 2025 16:11:47.919405937 CET	23	53206	89.147.218.37	192.168.2.15
Feb 11, 2025 16:11:47.919473886 CET	53206	23	192.168.2.15	89.147.218.37
Feb 11, 2025 16:11:47.923839092 CET	23	49282	67.220.114.32	192.168.2.15
Feb 11, 2025 16:11:47.923908949 CET	49282	23	192.168.2.15	67.220.114.32
Feb 11, 2025 16:11:47.924289942 CET	44984	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:47.924588919 CET	53374	23	192.168.2.15	166.242.235.68
Feb 11, 2025 16:11:47.929088116 CET	34411	44984	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:47.929311037 CET	44984	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:47.929342031 CET	23	53374	166.242.235.68	192.168.2.15
Feb 11, 2025 16:11:47.929388046 CET	53374	23	192.168.2.15	166.242.235.68
Feb 11, 2025 16:11:47.931401014 CET	44586	23	192.168.2.15	68.175.143.91
Feb 11, 2025 16:11:47.932390928 CET	44984	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:47.935972929 CET	51760	23	192.168.2.15	50.32.220.208
Feb 11, 2025 16:11:47.936233997 CET	23	44586	68.175.143.91	192.168.2.15
Feb 11, 2025 16:11:47.936304092 CET	44586	23	192.168.2.15	68.175.143.91
Feb 11, 2025 16:11:47.937166929 CET	34411	44984	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:47.937227011 CET	44984	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:47.940756083 CET	23	51760	50.32.220.208	192.168.2.15
Feb 11, 2025 16:11:47.940946102 CET	51760	23	192.168.2.15	50.32.220.208
Feb 11, 2025 16:11:47.941999912 CET	34411	44984	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:47.956909895 CET	59174	23	192.168.2.15	196.186.19.74
Feb 11, 2025 16:11:47.961738110 CET	23	59174	196.186.19.74	192.168.2.15
Feb 11, 2025 16:11:47.964961052 CET	59174	23	192.168.2.15	196.186.19.74
Feb 11, 2025 16:11:47.993613958 CET	39194	23	192.168.2.15	141.121.35.201
Feb 11, 2025 16:11:47.998532057 CET	23	39194	141.121.35.201	192.168.2.15
Feb 11, 2025 16:11:47.998596907 CET	39194	23	192.168.2.15	141.121.35.201
Feb 11, 2025 16:11:47.998985052 CET	59412	23	192.168.2.15	164.23.51.133
Feb 11, 2025 16:11:48.003828049 CET	23	59412	164.23.51.133	192.168.2.15
Feb 11, 2025 16:11:48.003902912 CET	59412	23	192.168.2.15	164.23.51.133
Feb 11, 2025 16:11:48.004928112 CET	45274	23	192.168.2.15	45.113.140.94
Feb 11, 2025 16:11:48.009814024 CET	23	45274	45.113.140.94	192.168.2.15
Feb 11, 2025 16:11:48.009912014 CET	45274	23	192.168.2.15	45.113.140.94
Feb 11, 2025 16:11:48.011290073 CET	54236	23	192.168.2.15	16.79.84.77
Feb 11, 2025 16:11:48.016705036 CET	23	54236	16.79.84.77	192.168.2.15
Feb 11, 2025 16:11:48.016756058 CET	54236	23	192.168.2.15	16.79.84.77
Feb 11, 2025 16:11:48.020042896 CET	49396	23	192.168.2.15	197.173.23.152
Feb 11, 2025 16:11:48.024885893 CET	23	49396	197.173.23.152	192.168.2.15
Feb 11, 2025 16:11:48.024962902 CET	49396	23	192.168.2.15	197.173.23.152
Feb 11, 2025 16:11:48.130752087 CET	46894	23	192.168.2.15	148.233.93.10
Feb 11, 2025 16:11:48.135556936 CET	23	46894	148.233.93.10	192.168.2.15
Feb 11, 2025 16:11:48.136984110 CET	46894	23	192.168.2.15	148.233.93.10
Feb 11, 2025 16:11:48.179877996 CET	58022	23	192.168.2.15	12.242.217.170
Feb 11, 2025 16:11:48.184875965 CET	23	58022	12.242.217.170	192.168.2.15
Feb 11, 2025 16:11:48.185025930 CET	58022	23	192.168.2.15	12.242.217.170
Feb 11, 2025 16:11:48.185787916 CET	55704	23	192.168.2.15	126.123.149.89
Feb 11, 2025 16:11:48.190645933 CET	23	55704	126.123.149.89	192.168.2.15
Feb 11, 2025 16:11:48.191024065 CET	55704	23	192.168.2.15	126.123.149.89
Feb 11, 2025 16:11:48.193689108 CET	35876	23	192.168.2.15	15.170.107.51
Feb 11, 2025 16:11:48.198508978 CET	23	35876	15.170.107.51	192.168.2.15
Feb 11, 2025 16:11:48.199068069 CET	35876	23	192.168.2.15	15.170.107.51
Feb 11, 2025 16:11:48.199068069 CET	41522	23	192.168.2.15	131.61.237.29
Feb 11, 2025 16:11:48.203862906 CET	23	41522	131.61.237.29	192.168.2.15
Feb 11, 2025 16:11:48.205641031 CET	41522	23	192.168.2.15	131.61.237.29
Feb 11, 2025 16:11:48.242652893 CET	33950	23	192.168.2.15	23.129.156.39
Feb 11, 2025 16:11:48.247447968 CET	23	33950	23.129.156.39	192.168.2.15
Feb 11, 2025 16:11:48.247517109 CET	33950	23	192.168.2.15	23.129.156.39
Feb 11, 2025 16:11:48.249562979 CET	45928	23	192.168.2.15	157.147.83.110
Feb 11, 2025 16:11:48.254342079 CET	23	45928	157.147.83.110	192.168.2.15
Feb 11, 2025 16:11:48.254410028 CET	45928	23	192.168.2.15	157.147.83.110
Feb 11, 2025 16:11:48.255417109 CET	46706	23	192.168.2.15	129.35.125.68
Feb 11, 2025 16:11:48.258132935 CET	54110	23	192.168.2.15	117.200.79.202
Feb 11, 2025 16:11:48.260154963 CET	23	46706	129.35.125.68	192.168.2.15
Feb 11, 2025 16:11:48.260211945 CET	46706	23	192.168.2.15	129.35.125.68
Feb 11, 2025 16:11:48.262990952 CET	23	54110	117.200.79.202	192.168.2.15
Feb 11, 2025 16:11:48.263055086 CET	54110	23	192.168.2.15	117.200.79.202
Feb 11, 2025 16:11:48.263258934 CET	43878	23	192.168.2.15	201.241.232.73
Feb 11, 2025 16:11:48.266535044 CET	42592	23	192.168.2.15	94.44.131.22
Feb 11, 2025 16:11:48.268033981 CET	23	43878	201.241.232.73	192.168.2.15
Feb 11, 2025 16:11:48.268083096 CET	43878	23	192.168.2.15	201.241.232.73
Feb 11, 2025 16:11:48.271351099 CET	23	42592	94.44.131.22	192.168.2.15
Feb 11, 2025 16:11:48.271420002 CET	42592	23	192.168.2.15	94.44.131.22
Feb 11, 2025 16:11:48.271768093 CET	37726	23	192.168.2.15	195.199.4.200
Feb 11, 2025 16:11:48.275301933 CET	44878	23	192.168.2.15	91.11.162.17
Feb 11, 2025 16:11:48.276534081 CET	23	37726	195.199.4.200	192.168.2.15
Feb 11, 2025 16:11:48.276619911 CET	37726	23	192.168.2.15	195.199.4.200
Feb 11, 2025 16:11:48.277451992 CET	43202	23	192.168.2.15	101.72.83.22
Feb 11, 2025 16:11:48.280133963 CET	23	44878	91.11.162.17	192.168.2.15
Feb 11, 2025 16:11:48.280177116 CET	44878	23	192.168.2.15	91.11.162.17
Feb 11, 2025 16:11:48.282246113 CET	23	43202	101.72.83.22	192.168.2.15
Feb 11, 2025 16:11:48.282397032 CET	43202	23	192.168.2.15	101.72.83.22
Feb 11, 2025 16:11:48.559573889 CET	34411	44984	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:48.559638023 CET	44984	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:48.559866905 CET	44984	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:48.584945917 CET	43202	23	192.168.2.15	101.72.83.22
Feb 11, 2025 16:11:48.584961891 CET	44878	23	192.168.2.15	91.11.162.17
Feb 11, 2025 16:11:48.584964037 CET	37726	23	192.168.2.15	195.199.4.200
Feb 11, 2025 16:11:48.584966898 CET	54110	23	192.168.2.15	117.200.79.202
Feb 11, 2025 16:11:48.584966898 CET	43878	23	192.168.2.15	201.241.232.73
Feb 11, 2025 16:11:48.584979057 CET	42592	23	192.168.2.15	94.44.131.22
Feb 11, 2025 16:11:48.584979057 CET	46706	23	192.168.2.15	129.35.125.68
Feb 11, 2025 16:11:48.584980011 CET	45928	23	192.168.2.15	157.147.83.110
Feb 11, 2025 16:11:48.584980011 CET	33950	23	192.168.2.15	23.129.156.39
Feb 11, 2025 16:11:48.584985018 CET	41522	23	192.168.2.15	131.61.237.29
Feb 11, 2025 16:11:48.584997892 CET	55704	23	192.168.2.15	126.123.149.89
Feb 11, 2025 16:11:48.584997892 CET	46894	23	192.168.2.15	148.233.93.10
Feb 11, 2025 16:11:48.584997892 CET	49396	23	192.168.2.15	197.173.23.152
Feb 11, 2025 16:11:48.585007906 CET	58022	23	192.168.2.15	12.242.217.170
Feb 11, 2025 16:11:48.585009098 CET	35876	23	192.168.2.15	15.170.107.51
Feb 11, 2025 16:11:48.585012913 CET	54236	23	192.168.2.15	16.79.84.77
Feb 11, 2025 16:11:48.585016966 CET	39194	23	192.168.2.15	141.121.35.201
Feb 11, 2025 16:11:48.585012913 CET	45274	23	192.168.2.15	45.113.140.94
Feb 11, 2025 16:11:48.585026979 CET	51760	23	192.168.2.15	50.32.220.208
Feb 11, 2025 16:11:48.585026979 CET	59412	23	192.168.2.15	164.23.51.133
Feb 11, 2025 16:11:48.585036993 CET	59174	23	192.168.2.15	196.186.19.74
Feb 11, 2025 16:11:48.585036993 CET	44586	23	192.168.2.15	68.175.143.91
Feb 11, 2025 16:11:48.585047960 CET	49282	23	192.168.2.15	67.220.114.32
Feb 11, 2025 16:11:48.585050106 CET	53374	23	192.168.2.15	166.242.235.68
Feb 11, 2025 16:11:48.585050106 CET	53206	23	192.168.2.15	89.147.218.37
Feb 11, 2025 16:11:48.585053921 CET	53658	23	192.168.2.15	17.235.230.54
Feb 11, 2025 16:11:48.585053921 CET	45944	23	192.168.2.15	62.209.219.207
Feb 11, 2025 16:11:48.585073948 CET	48334	23	192.168.2.15	51.168.247.220
Feb 11, 2025 16:11:48.589869976 CET	23	43202	101.72.83.22	192.168.2.15
Feb 11, 2025 16:11:48.589919090 CET	43202	23	192.168.2.15	101.72.83.22
Feb 11, 2025 16:11:48.590399981 CET	23	54110	117.200.79.202	192.168.2.15
Feb 11, 2025 16:11:48.590413094 CET	23	43878	201.241.232.73	192.168.2.15
Feb 11, 2025 16:11:48.590423107 CET	23	37726	195.199.4.200	192.168.2.15
Feb 11, 2025 16:11:48.590434074 CET	23	44878	91.11.162.17	192.168.2.15
Feb 11, 2025 16:11:48.590447903 CET	43878	23	192.168.2.15	201.241.232.73
Feb 11, 2025 16:11:48.590447903 CET	54110	23	192.168.2.15	117.200.79.202
Feb 11, 2025 16:11:48.590456009 CET	23	41522	131.61.237.29	192.168.2.15
Feb 11, 2025 16:11:48.590465069 CET	37726	23	192.168.2.15	195.199.4.200
Feb 11, 2025 16:11:48.590471983 CET	23	42592	94.44.131.22	192.168.2.15
Feb 11, 2025 16:11:48.590472937 CET	44878	23	192.168.2.15	91.11.162.17
Feb 11, 2025 16:11:48.590495110 CET	41522	23	192.168.2.15	131.61.237.29
Feb 11, 2025 16:11:48.590495110 CET	23	46706	129.35.125.68	192.168.2.15
Feb 11, 2025 16:11:48.590508938 CET	23	45928	157.147.83.110	192.168.2.15
Feb 11, 2025 16:11:48.590516090 CET	42592	23	192.168.2.15	94.44.131.22
Feb 11, 2025 16:11:48.590526104 CET	23	33950	23.129.156.39	192.168.2.15
Feb 11, 2025 16:11:48.590539932 CET	23	55704	126.123.149.89	192.168.2.15
Feb 11, 2025 16:11:48.590540886 CET	45928	23	192.168.2.15	157.147.83.110
Feb 11, 2025 16:11:48.590552092 CET	23	46894	148.233.93.10	192.168.2.15
Feb 11, 2025 16:11:48.590557098 CET	46706	23	192.168.2.15	129.35.125.68
Feb 11, 2025 16:11:48.590569019 CET	33950	23	192.168.2.15	23.129.156.39
Feb 11, 2025 16:11:48.590585947 CET	55704	23	192.168.2.15	126.123.149.89
Feb 11, 2025 16:11:48.590585947 CET	46894	23	192.168.2.15	148.233.93.10
Feb 11, 2025 16:11:48.590603113 CET	23	49396	197.173.23.152	192.168.2.15
Feb 11, 2025 16:11:48.590615034 CET	23	35876	15.170.107.51	192.168.2.15
Feb 11, 2025 16:11:48.590636969 CET	23	58022	12.242.217.170	192.168.2.15
Feb 11, 2025 16:11:48.590640068 CET	49396	23	192.168.2.15	197.173.23.152
Feb 11, 2025 16:11:48.590648890 CET	23	39194	141.121.35.201	192.168.2.15
Feb 11, 2025 16:11:48.590660095 CET	23	51760	50.32.220.208	192.168.2.15
Feb 11, 2025 16:11:48.590672970 CET	35876	23	192.168.2.15	15.170.107.51
Feb 11, 2025 16:11:48.590675116 CET	23	59412	164.23.51.133	192.168.2.15
Feb 11, 2025 16:11:48.590683937 CET	58022	23	192.168.2.15	12.242.217.170
Feb 11, 2025 16:11:48.590684891 CET	39194	23	192.168.2.15	141.121.35.201
Feb 11, 2025 16:11:48.590688944 CET	23	54236	16.79.84.77	192.168.2.15
Feb 11, 2025 16:11:48.590701103 CET	23	45274	45.113.140.94	192.168.2.15
Feb 11, 2025 16:11:48.590722084 CET	51760	23	192.168.2.15	50.32.220.208
Feb 11, 2025 16:11:48.590734005 CET	54236	23	192.168.2.15	16.79.84.77
Feb 11, 2025 16:11:48.590734005 CET	45274	23	192.168.2.15	45.113.140.94
Feb 11, 2025 16:11:48.590742111 CET	59412	23	192.168.2.15	164.23.51.133
Feb 11, 2025 16:11:48.590765953 CET	23	59174	196.186.19.74	192.168.2.15
Feb 11, 2025 16:11:48.590775013 CET	23	44586	68.175.143.91	192.168.2.15
Feb 11, 2025 16:11:48.590785027 CET	23	49282	67.220.114.32	192.168.2.15
Feb 11, 2025 16:11:48.590797901 CET	23	53374	166.242.235.68	192.168.2.15
Feb 11, 2025 16:11:48.590811014 CET	23	53206	89.147.218.37	192.168.2.15
Feb 11, 2025 16:11:48.590815067 CET	59174	23	192.168.2.15	196.186.19.74
Feb 11, 2025 16:11:48.590815067 CET	49282	23	192.168.2.15	67.220.114.32
Feb 11, 2025 16:11:48.590823889 CET	23	53658	17.235.230.54	192.168.2.15
Feb 11, 2025 16:11:48.590828896 CET	44586	23	192.168.2.15	68.175.143.91
Feb 11, 2025 16:11:48.590850115 CET	53374	23	192.168.2.15	166.242.235.68
Feb 11, 2025 16:11:48.590850115 CET	53206	23	192.168.2.15	89.147.218.37
Feb 11, 2025 16:11:48.590872049 CET	53658	23	192.168.2.15	17.235.230.54
Feb 11, 2025 16:11:48.592793941 CET	23	45944	62.209.219.207	192.168.2.15
Feb 11, 2025 16:11:48.592832088 CET	45944	23	192.168.2.15	62.209.219.207
Feb 11, 2025 16:11:48.592833996 CET	23	48334	51.168.247.220	192.168.2.15
Feb 11, 2025 16:11:48.592873096 CET	48334	23	192.168.2.15	51.168.247.220
Feb 11, 2025 16:11:49.583741903 CET	45032	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:49.588542938 CET	34411	45032	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:49.588635921 CET	45032	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:49.589621067 CET	45032	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:49.594445944 CET	34411	45032	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:49.594505072 CET	45032	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:49.599344015 CET	34411	45032	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:50.194308996 CET	34411	45032	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:50.194372892 CET	45032	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:50.194406986 CET	45032	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:51.209160089 CET	45034	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:51.217206955 CET	34411	45034	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:51.217319012 CET	45034	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:51.219302893 CET	45034	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:51.227303028 CET	34411	45034	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:51.227370024 CET	45034	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:51.233771086 CET	34411	45034	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:51.840557098 CET	34411	45034	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:51.840670109 CET	45034	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:51.840717077 CET	45034	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:52.856848001 CET	45036	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:52.862530947 CET	34411	45036	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:52.862587929 CET	45036	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:52.864504099 CET	45036	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:52.871124029 CET	34411	45036	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:52.871191978 CET	45036	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:52.878562927 CET	34411	45036	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:53.485332966 CET	34411	45036	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:53.485549927 CET	45036	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:53.485549927 CET	45036	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:54.494890928 CET	45038	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:54.499747992 CET	34411	45038	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:54.499821901 CET	45038	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:54.501703024 CET	45038	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:54.506500006 CET	34411	45038	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:54.506582022 CET	45038	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:54.511370897 CET	34411	45038	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:55.112567902 CET	34411	45038	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:55.112668991 CET	45038	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:55.112668991 CET	45038	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:56.125809908 CET	45040	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:56.135940075 CET	34411	45040	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:56.136054039 CET	45040	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:56.136933088 CET	45040	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:56.145152092 CET	34411	45040	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:56.145212889 CET	45040	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:56.150192022 CET	34411	45040	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:56.759480000 CET	34411	45040	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:56.759556055 CET	45040	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:56.759593964 CET	45040	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:57.769993067 CET	45042	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:57.774801016 CET	34411	45042	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:57.774862051 CET	45042	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:57.775656939 CET	45042	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:57.781609058 CET	34411	45042	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:57.781744957 CET	45042	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:57.786477089 CET	34411	45042	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:58.378612995 CET	34411	45042	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:58.378674984 CET	45042	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:58.378714085 CET	45042	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:59.387464046 CET	45044	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:59.392251015 CET	34411	45044	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:59.392335892 CET	45044	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:59.393045902 CET	45044	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:59.397800922 CET	34411	45044	185.93.89.106	192.168.2.15
Feb 11, 2025 16:11:59.398171902 CET	45044	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:11:59.402980089 CET	34411	45044	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:00.022327900 CET	34411	45044	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:00.022428036 CET	45044	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:00.022428036 CET	45044	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:01.035120010 CET	45046	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:01.039946079 CET	34411	45046	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:01.040003061 CET	45046	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:01.040683985 CET	45046	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:01.045605898 CET	34411	45046	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:01.045665026 CET	45046	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:01.050435066 CET	34411	45046	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:01.654867887 CET	34411	45046	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:01.654958963 CET	45046	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:01.654958963 CET	45046	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:02.663182020 CET	45048	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:02.667993069 CET	34411	45048	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:02.668052912 CET	45048	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:02.668736935 CET	45048	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:02.673535109 CET	34411	45048	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:02.673585892 CET	45048	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:02.678339005 CET	34411	45048	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:03.273180008 CET	34411	45048	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:03.273276091 CET	45048	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:03.273324966 CET	45048	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:04.281955957 CET	45050	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:04.286812067 CET	34411	45050	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:04.286865950 CET	45050	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:04.287543058 CET	45050	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:04.292282104 CET	34411	45050	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:04.292342901 CET	45050	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:04.297097921 CET	34411	45050	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:04.889162064 CET	34411	45050	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:04.889221907 CET	45050	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:04.889260054 CET	45050	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:05.900783062 CET	45052	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:05.906541109 CET	34411	45052	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:05.906601906 CET	45052	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:05.907942057 CET	45052	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:05.913424015 CET	34411	45052	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:05.913476944 CET	45052	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:05.919723034 CET	34411	45052	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:06.529819012 CET	34411	45052	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:06.529895067 CET	45052	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:06.529933929 CET	45052	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:07.542263985 CET	45054	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:07.547071934 CET	34411	45054	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:07.547127008 CET	45054	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:07.547853947 CET	45054	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:07.552658081 CET	34411	45054	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:07.552702904 CET	45054	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:07.557498932 CET	34411	45054	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:08.168776035 CET	34411	45054	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:08.168854952 CET	45054	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:08.168910980 CET	45054	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:09.177618980 CET	45056	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:09.182461023 CET	34411	45056	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:09.182528973 CET	45056	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:09.183126926 CET	45056	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:09.187907934 CET	34411	45056	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:09.187984943 CET	45056	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:09.192827940 CET	34411	45056	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:09.823103905 CET	34411	45056	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:09.823236942 CET	45056	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:09.823236942 CET	45056	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:10.832751989 CET	45058	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:10.840286016 CET	34411	45058	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:10.840343952 CET	45058	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:10.841845036 CET	45058	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:10.849391937 CET	34411	45058	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:10.849484921 CET	45058	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:10.857367039 CET	34411	45058	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:11.446552038 CET	34411	45058	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:11.446619034 CET	45058	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:11.446651936 CET	45058	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:12.454788923 CET	45060	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:12.459626913 CET	34411	45060	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:12.459677935 CET	45060	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:12.460346937 CET	45060	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:12.465159893 CET	34411	45060	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:12.465219021 CET	45060	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:12.470094919 CET	34411	45060	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:13.073970079 CET	34411	45060	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:13.074067116 CET	45060	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:13.074120045 CET	45060	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:14.083003044 CET	45062	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:14.087884903 CET	34411	45062	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:14.087963104 CET	45062	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:14.088762045 CET	45062	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:14.093576908 CET	34411	45062	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:14.093617916 CET	45062	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:14.098372936 CET	34411	45062	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:14.710997105 CET	34411	45062	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:14.711064100 CET	45062	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:14.711126089 CET	45062	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:15.719759941 CET	45064	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:15.724580050 CET	34411	45064	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:15.724666119 CET	45064	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:15.725560904 CET	45064	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:15.730331898 CET	34411	45064	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:15.730391979 CET	45064	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:15.735138893 CET	34411	45064	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:16.335364103 CET	34411	45064	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:16.335449934 CET	45064	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:16.335503101 CET	45064	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:17.343991041 CET	45066	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:17.348778963 CET	34411	45066	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:17.348859072 CET	45066	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:17.349723101 CET	45066	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:17.354482889 CET	34411	45066	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:17.354531050 CET	45066	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:17.359297991 CET	34411	45066	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:17.997534990 CET	34411	45066	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:17.997612953 CET	45066	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:17.997661114 CET	45066	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:19.006221056 CET	45068	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:19.011149883 CET	34411	45068	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:19.011205912 CET	45068	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:19.011954069 CET	45068	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:19.016763926 CET	34411	45068	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:19.016823053 CET	45068	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:19.021614075 CET	34411	45068	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:19.617548943 CET	34411	45068	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:19.617702961 CET	45068	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:19.617747068 CET	45068	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:20.627011061 CET	45070	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:20.631856918 CET	34411	45070	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:20.631922007 CET	45070	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:20.632767916 CET	45070	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:20.637561083 CET	34411	45070	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:20.637605906 CET	45070	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:20.642410994 CET	34411	45070	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:21.252214909 CET	34411	45070	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:21.252338886 CET	45070	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:21.252377033 CET	45070	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:22.261674881 CET	45072	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:22.266520023 CET	34411	45072	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:22.266609907 CET	45072	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:22.267514944 CET	45072	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:22.272319078 CET	34411	45072	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:22.272372961 CET	45072	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:22.277283907 CET	34411	45072	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:22.868412971 CET	34411	45072	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:22.868566036 CET	45072	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:22.868566036 CET	45072	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:23.882003069 CET	45074	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:23.886794090 CET	34411	45074	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:23.886858940 CET	45074	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:23.887516975 CET	45074	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:23.892309904 CET	34411	45074	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:23.892375946 CET	45074	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:23.897160053 CET	34411	45074	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:24.489401102 CET	34411	45074	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:24.489552021 CET	45074	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:24.489761114 CET	45074	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:25.498387098 CET	45076	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:25.503258944 CET	34411	45076	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:25.503339052 CET	45076	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:25.504036903 CET	45076	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:25.508795023 CET	34411	45076	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:25.508852959 CET	45076	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:25.513588905 CET	34411	45076	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:26.114358902 CET	34411	45076	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:26.114522934 CET	45076	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:26.114553928 CET	45076	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:27.123250961 CET	45078	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:27.128072977 CET	34411	45078	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:27.128155947 CET	45078	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:27.128882885 CET	45078	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:27.133748055 CET	34411	45078	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:27.133807898 CET	45078	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:27.138619900 CET	34411	45078	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:27.731676102 CET	34411	45078	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:27.731825113 CET	45078	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:27.731825113 CET	45078	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:28.740998030 CET	45080	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:28.745829105 CET	34411	45080	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:28.745937109 CET	45080	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:28.746808052 CET	45080	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:28.751586914 CET	34411	45080	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:28.751652956 CET	45080	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:28.756377935 CET	34411	45080	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:29.389058113 CET	34411	45080	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:29.389195919 CET	45080	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:29.389240980 CET	45080	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:30.408093929 CET	45082	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:30.413254976 CET	34411	45082	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:30.413392067 CET	45082	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:30.414284945 CET	45082	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:30.419286013 CET	34411	45082	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:30.419364929 CET	45082	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:30.424249887 CET	34411	45082	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:31.015002966 CET	34411	45082	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:31.015139103 CET	45082	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:31.015199900 CET	45082	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:32.023991108 CET	45084	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:32.028878927 CET	34411	45084	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:32.028975010 CET	45084	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:32.029952049 CET	45084	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:32.034770966 CET	34411	45084	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:32.034851074 CET	45084	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:32.039625883 CET	34411	45084	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:32.641263008 CET	34411	45084	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:32.641493082 CET	45084	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:32.641546011 CET	45084	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:33.650907040 CET	45086	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:33.655827999 CET	34411	45086	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:33.655911922 CET	45086	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:33.656960011 CET	45086	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:33.661755085 CET	34411	45086	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:33.661834955 CET	45086	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:33.666655064 CET	34411	45086	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:34.396187067 CET	34411	45086	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:34.396325111 CET	45086	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:34.396384954 CET	45086	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:34.396461010 CET	34411	45086	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:34.396573067 CET	45086	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:35.405926943 CET	45088	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:35.411118984 CET	34411	45088	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:35.411223888 CET	45088	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:35.412045956 CET	45088	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:35.416810036 CET	34411	45088	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:35.416868925 CET	45088	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:35.421698093 CET	34411	45088	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:36.036777020 CET	34411	45088	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:36.036935091 CET	45088	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:36.036935091 CET	45088	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:37.046881914 CET	45090	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:37.051677942 CET	34411	45090	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:37.051759005 CET	45090	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:37.052881956 CET	45090	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:37.057626963 CET	34411	45090	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:37.057703972 CET	45090	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:37.062489033 CET	34411	45090	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:37.676557064 CET	34411	45090	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:37.676712036 CET	45090	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:37.676754951 CET	45090	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:38.686367035 CET	45092	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:38.691181898 CET	34411	45092	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:38.691282988 CET	45092	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:38.692428112 CET	45092	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:38.697164059 CET	34411	45092	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:38.697223902 CET	45092	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:38.702050924 CET	34411	45092	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:39.296994925 CET	34411	45092	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:39.297189951 CET	45092	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:39.297189951 CET	45092	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:40.306663990 CET	45094	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:40.311481953 CET	34411	45094	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:40.311554909 CET	45094	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:40.312338114 CET	45094	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:40.317143917 CET	34411	45094	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:40.317213058 CET	45094	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:40.322088957 CET	34411	45094	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:40.929054022 CET	34411	45094	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:40.929168940 CET	45094	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:40.929229975 CET	45094	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:41.938549995 CET	45096	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:41.943447113 CET	34411	45096	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:41.943583965 CET	45096	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:41.944681883 CET	45096	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:41.949479103 CET	34411	45096	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:41.949587107 CET	45096	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:41.954387903 CET	34411	45096	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:42.567760944 CET	34411	45096	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:42.567898035 CET	45096	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:42.567950010 CET	45096	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:43.577960968 CET	45098	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:43.582871914 CET	34411	45098	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:43.582971096 CET	45098	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:43.584140062 CET	45098	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:43.588943005 CET	34411	45098	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:43.589021921 CET	45098	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:43.593826056 CET	34411	45098	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:44.191485882 CET	34411	45098	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:44.191788912 CET	45098	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:44.191788912 CET	45098	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:45.201292038 CET	45100	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:45.206197977 CET	34411	45100	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:45.206305027 CET	45100	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:45.207498074 CET	45100	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:45.212301970 CET	34411	45100	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:45.212382078 CET	45100	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:45.217180967 CET	34411	45100	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:45.842492104 CET	34411	45100	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:45.842653990 CET	45100	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:45.842708111 CET	45100	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:46.852782965 CET	45102	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:46.858829021 CET	34411	45102	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:46.858903885 CET	45102	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:46.859888077 CET	45102	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:46.865868092 CET	34411	45102	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:46.865950108 CET	45102	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:46.871905088 CET	34411	45102	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:47.492950916 CET	34411	45102	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:47.493118048 CET	45102	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:47.493170977 CET	45102	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:48.503242970 CET	45104	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:48.508168936 CET	34411	45104	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:48.508239985 CET	45104	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:48.509294987 CET	45104	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:48.514028072 CET	34411	45104	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:48.514085054 CET	45104	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:48.518871069 CET	34411	45104	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:49.118846893 CET	34411	45104	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:49.118968964 CET	45104	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:49.118968964 CET	45104	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:50.131788969 CET	45106	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:50.136641026 CET	34411	45106	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:50.136688948 CET	45106	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:50.137339115 CET	45106	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:50.142163992 CET	34411	45106	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:50.142220974 CET	45106	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:50.147115946 CET	34411	45106	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:50.750858068 CET	34411	45106	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:50.750984907 CET	45106	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:50.751019955 CET	45106	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:51.760534048 CET	45108	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:51.765762091 CET	34411	45108	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:51.765847921 CET	45108	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:51.766771078 CET	45108	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:51.771969080 CET	34411	45108	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:51.772044897 CET	45108	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:51.777331114 CET	34411	45108	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:52.368581057 CET	34411	45108	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:52.368849039 CET	45108	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:52.368849039 CET	45108	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:53.386219025 CET	45110	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:53.393184900 CET	34411	45110	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:53.393253088 CET	45110	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:53.394141912 CET	45110	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:53.401173115 CET	34411	45110	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:53.401238918 CET	45110	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:53.408235073 CET	34411	45110	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:54.035329103 CET	34411	45110	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:54.035530090 CET	45110	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:54.035593987 CET	45110	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:55.046407938 CET	45112	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:55.051208973 CET	34411	45112	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:55.051286936 CET	45112	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:55.052464008 CET	45112	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:55.057221889 CET	34411	45112	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:55.057293892 CET	45112	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:55.062153101 CET	34411	45112	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:55.668332100 CET	34411	45112	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:55.668492079 CET	45112	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:55.668560982 CET	45112	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:56.725615978 CET	45114	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:56.730474949 CET	34411	45114	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:56.730551958 CET	45114	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:56.731494904 CET	45114	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:56.736294985 CET	34411	45114	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:56.736530066 CET	45114	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:56.741261959 CET	34411	45114	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:57.341944933 CET	34411	45114	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:57.342072010 CET	45114	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:57.342127085 CET	45114	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:58.355665922 CET	45116	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:58.360477924 CET	34411	45116	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:58.360578060 CET	45116	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:58.361586094 CET	45116	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:58.366317987 CET	34411	45116	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:58.366385937 CET	45116	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:58.371181965 CET	34411	45116	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:59.008745909 CET	34411	45116	185.93.89.106	192.168.2.15
Feb 11, 2025 16:12:59.008872032 CET	45116	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:12:59.008913994 CET	45116	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:00.018475056 CET	45118	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:00.023307085 CET	34411	45118	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:00.023353100 CET	45118	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:00.024148941 CET	45118	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:00.028933048 CET	34411	45118	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:00.028973103 CET	45118	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:00.033816099 CET	34411	45118	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:00.654469013 CET	34411	45118	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:00.654679060 CET	45118	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:00.654679060 CET	45118	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:01.664819956 CET	45120	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:01.669670105 CET	34411	45120	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:01.669749022 CET	45120	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:01.670670033 CET	45120	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:01.675386906 CET	34411	45120	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:01.675457001 CET	45120	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:01.680207014 CET	34411	45120	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:02.276679993 CET	34411	45120	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:02.276846886 CET	45120	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:02.276885986 CET	45120	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:03.287731886 CET	45122	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:03.294028044 CET	34411	45122	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:03.294135094 CET	45122	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:03.295082092 CET	45122	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:03.301642895 CET	34411	45122	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:03.301717997 CET	45122	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:03.307836056 CET	34411	45122	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:03.910481930 CET	34411	45122	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:03.910670042 CET	45122	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:03.910718918 CET	45122	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:04.919991016 CET	45124	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:04.924877882 CET	34411	45124	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:04.924947977 CET	45124	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:04.925709963 CET	45124	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:04.930500031 CET	34411	45124	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:04.930566072 CET	45124	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:04.935399055 CET	34411	45124	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:05.530273914 CET	34411	45124	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:05.530446053 CET	45124	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:05.530498981 CET	45124	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:06.587552071 CET	45126	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:06.592456102 CET	34411	45126	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:06.592519999 CET	45126	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:06.593194008 CET	45126	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:06.597946882 CET	34411	45126	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:06.598004103 CET	45126	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:06.602852106 CET	34411	45126	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:07.222960949 CET	34411	45126	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:07.223146915 CET	45126	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:07.223190069 CET	45126	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:08.232121944 CET	45128	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:08.236989021 CET	34411	45128	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:08.237061977 CET	45128	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:08.237967014 CET	45128	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:08.242753983 CET	34411	45128	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:08.242820024 CET	45128	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:08.247641087 CET	34411	45128	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:08.851510048 CET	34411	45128	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:08.851604939 CET	45128	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:08.851650953 CET	45128	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:09.872021914 CET	45130	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:09.876900911 CET	34411	45130	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:09.876960039 CET	45130	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:09.877938032 CET	45130	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:09.882687092 CET	34411	45130	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:09.882735968 CET	45130	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:09.887561083 CET	34411	45130	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:10.487982035 CET	34411	45130	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:10.488179922 CET	45130	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:10.488256931 CET	45130	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:11.498089075 CET	45132	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:11.502918005 CET	34411	45132	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:11.503005028 CET	45132	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:11.504189014 CET	45132	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:11.508965969 CET	34411	45132	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:11.509038925 CET	45132	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:11.513848066 CET	34411	45132	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:21.512368917 CET	45132	34411	192.168.2.15	185.93.89.106
Feb 11, 2025 16:13:21.517215967 CET	34411	45132	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:21.685024023 CET	34411	45132	185.93.89.106	192.168.2.15
Feb 11, 2025 16:13:21.685220003 CET	45132	34411	192.168.2.15	185.93.89.106

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 11, 2025 16:11:47.898241043 CET	45630	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:11:47.921910048 CET	53	45630	8.8.8.8	192.168.2.15
Feb 11, 2025 16:11:49.565985918 CET	48737	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:11:49.582978010 CET	53	48737	8.8.8.8	192.168.2.15
Feb 11, 2025 16:11:51.198579073 CET	57997	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:11:51.208467007 CET	53	57997	8.8.8.8	192.168.2.15
Feb 11, 2025 16:11:52.843223095 CET	59282	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:11:52.855808973 CET	53	59282	8.8.8.8	192.168.2.15
Feb 11, 2025 16:11:54.487682104 CET	40974	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:11:54.493848085 CET	53	40974	8.8.8.8	192.168.2.15
Feb 11, 2025 16:11:56.115652084 CET	43889	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:11:56.125158072 CET	53	43889	8.8.8.8	192.168.2.15
Feb 11, 2025 16:11:57.761948109 CET	35202	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:11:57.769457102 CET	53	35202	8.8.8.8	192.168.2.15
Feb 11, 2025 16:11:59.380789042 CET	58655	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:11:59.387048960 CET	53	58655	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:01.023823023 CET	56972	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:01.034629107 CET	53	56972	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:02.656434059 CET	45848	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:02.662739038 CET	53	45848	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:04.274957895 CET	58248	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:04.281572104 CET	53	58248	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:05.890929937 CET	34173	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:05.900285959 CET	53	34173	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:07.531478882 CET	41739	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:07.541709900 CET	53	41739	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:09.170445919 CET	46249	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:09.177134991 CET	53	46249	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:10.825180054 CET	45213	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:10.832355976 CET	53	45213	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:12.447964907 CET	36724	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:12.454418898 CET	53	36724	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:14.076049089 CET	34584	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:14.082487106 CET	53	34584	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:15.712847948 CET	46356	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:15.719302893 CET	53	46356	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:17.337238073 CET	49487	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:17.343542099 CET	53	49487	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:18.999217033 CET	42501	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:19.005759001 CET	53	42501	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:20.619915962 CET	59500	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:20.626560926 CET	53	59500	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:22.254370928 CET	49376	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:22.261104107 CET	53	49376	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:23.870529890 CET	60022	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:23.881412029 CET	53	60022	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:25.491545916 CET	53667	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:25.497920990 CET	53	53667	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:27.116265059 CET	41972	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:27.122694969 CET	53	41972	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:28.734201908 CET	51182	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:28.740490913 CET	53	51182	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:30.401041031 CET	49737	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:30.407407045 CET	53	49737	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:32.016913891 CET	48382	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:32.023366928 CET	53	48382	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:33.643923044 CET	39006	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:33.650176048 CET	53	39006	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:35.398770094 CET	60467	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:35.405323029 CET	53	60467	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:37.039876938 CET	60276	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:37.046228886 CET	53	60276	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:38.679390907 CET	39750	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:38.685691118 CET	53	39750	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:40.299751043 CET	58177	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:40.306159973 CET	53	58177	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:41.931458950 CET	58156	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:41.937824011 CET	53	58156	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:43.570569038 CET	48567	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:43.577055931 CET	53	48567	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:45.194226027 CET	46110	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:45.200424910 CET	53	46110	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:46.844865084 CET	37699	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:46.852247953 CET	53	37699	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:48.495739937 CET	43904	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:48.502688885 CET	53	43904	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:50.120734930 CET	40085	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:50.131385088 CET	53	40085	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:51.753489017 CET	46786	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:51.759901047 CET	53	46786	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:53.370815039 CET	51413	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:53.385679960 CET	53	51413	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:55.038650036 CET	40897	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:55.045886993 CET	53	40897	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:56.671061993 CET	58589	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:56.724983931 CET	53	58589	8.8.8.8	192.168.2.15
Feb 11, 2025 16:12:58.344611883 CET	59043	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:12:58.355031013 CET	53	59043	8.8.8.8	192.168.2.15
Feb 11, 2025 16:13:00.011724949 CET	51363	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:13:00.017916918 CET	53	51363	8.8.8.8	192.168.2.15
Feb 11, 2025 16:13:01.657794952 CET	33450	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:13:01.664206028 CET	53	33450	8.8.8.8	192.168.2.15
Feb 11, 2025 16:13:03.279330969 CET	43115	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:13:03.287300110 CET	53	43115	8.8.8.8	192.168.2.15
Feb 11, 2025 16:13:04.913033009 CET	60313	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:13:04.919557095 CET	53	60313	8.8.8.8	192.168.2.15
Feb 11, 2025 16:13:06.532593012 CET	59982	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:13:06.586854935 CET	53	59982	8.8.8.8	192.168.2.15
Feb 11, 2025 16:13:08.225224972 CET	57984	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:13:08.231565952 CET	53	57984	8.8.8.8	192.168.2.15
Feb 11, 2025 16:13:09.854046106 CET	39851	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:13:09.871417046 CET	53	39851	8.8.8.8	192.168.2.15
Feb 11, 2025 16:13:11.491152048 CET	40836	53	192.168.2.15	8.8.8.8
Feb 11, 2025 16:13:11.497422934 CET	53	40836	8.8.8.8	192.168.2.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 11, 2025 16:11:47.898241043 CET	192.168.2.15	8.8.8.8	0x786b	Standard query (0)	gokittler.ru	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:11:49.565985918 CET	192.168.2.15	8.8.8.8	0xecb8	Standard query (0)	cuttiecats.ru	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:11:51.198579073 CET	192.168.2.15	8.8.8.8	0x758d	Standard query (0)	mykittler.ru. [malformed]	256	439	false
Feb 11, 2025 16:11:52.843223095 CET	192.168.2.15	8.8.8.8	0x4ddf	Standard query (0)	thekittler.ru	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:11:54.487682104 CET	192.168.2.15	8.8.8.8	0x3e2d	Standard query (0)	kittler.ru. [malformed]	256	442	false
Feb 11, 2025 16:11:56.115652084 CET	192.168.2.15	8.8.8.8	0x4850	Standard query (0)	cats-master.ru	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:11:57.761948109 CET	192.168.2.15	8.8.8.8	0x40aa	Standard query (0)	kittlez.ru. [malformed]	256	445	false
Feb 11, 2025 16:11:59.380789042 CET	192.168.2.15	8.8.8.8	0x476d	Standard query (0)	cuttiecats.ru. [malformed]	256	447	false
Feb 11, 2025 16:12:01.023823023 CET	192.168.2.15	8.8.8.8	0xdb8	Standard query (0)	cat-are-here.ru	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:12:02.656434059 CET	192.168.2.15	8.8.8.8	0x1353	Standard query (0)	thekittler.ru. [malformed]	256	450	false
Feb 11, 2025 16:12:04.274957895 CET	192.168.2.15	8.8.8.8	0x831d	Standard query (0)	qittler.ru. [malformed]	256	452	false
Feb 11, 2025 16:12:05.890929937 CET	192.168.2.15	8.8.8.8	0xbce3	Standard query (0)	kittlerer.ru	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:12:07.531478882 CET	192.168.2.15	8.8.8.8	0xf6a1	Standard query (0)	thekittler.ru	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:12:09.170445919 CET	192.168.2.15	8.8.8.8	0xc565	Standard query (0)	polizei.su. [malformed]	256	457	false
Feb 11, 2025 16:12:10.825180054 CET	192.168.2.15	8.8.8.8	0xb62c	Standard query (0)	polizei.su. [malformed]	256	458	false
Feb 11, 2025 16:12:12.447964907 CET	192.168.2.15	8.8.8.8	0xca80	Standard query (0)	thekittler.ru. [malformed]	256	460	false
Feb 11, 2025 16:12:14.076049089 CET	192.168.2.15	8.8.8.8	0x5ccd	Standard query (0)	kittler.ru. [malformed]	256	462	false
Feb 11, 2025 16:12:15.712847948 CET	192.168.2.15	8.8.8.8	0xa3cc	Standard query (0)	cat-are-here.ru. [malformed]	256	463	false
Feb 11, 2025 16:12:17.337238073 CET	192.168.2.15	8.8.8.8	0x1a64	Standard query (0)	cat-are-here.ru. [malformed]	256	465	false
Feb 11, 2025 16:12:18.999217033 CET	192.168.2.15	8.8.8.8	0x763	Standard query (0)	kittler.ru. [malformed]	256	467	false
Feb 11, 2025 16:12:20.619915962 CET	192.168.2.15	8.8.8.8	0xd109	Standard query (0)	polizei.su. [malformed]	256	468	false
Feb 11, 2025 16:12:22.254370928 CET	192.168.2.15	8.8.8.8	0xc747	Standard query (0)	thekittler.ru. [malformed]	256	470	false
Feb 11, 2025 16:12:23.870529890 CET	192.168.2.15	8.8.8.8	0x970e	Standard query (0)	cats-master.ru	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:12:25.491545916 CET	192.168.2.15	8.8.8.8	0x2c3f	Standard query (0)	qittler.ru. [malformed]	256	473	false
Feb 11, 2025 16:12:27.116265059 CET	192.168.2.15	8.8.8.8	0xb7fc	Standard query (0)	cuttiecats.ru. [malformed]	256	475	false
Feb 11, 2025 16:12:28.734201908 CET	192.168.2.15	8.8.8.8	0x7993	Standard query (0)	kittler.ru. [malformed]	256	476	false
Feb 11, 2025 16:12:30.401041031 CET	192.168.2.15	8.8.8.8	0x7e9c	Standard query (0)	thekittler.ru. [malformed]	256	478	false
Feb 11, 2025 16:12:32.016913891 CET	192.168.2.15	8.8.8.8	0x31d0	Standard query (0)	gokittler.ru. [malformed]	256	480	false
Feb 11, 2025 16:12:33.643923044 CET	192.168.2.15	8.8.8.8	0xb332	Standard query (0)	mykittler.ru. [malformed]	256	481	false
Feb 11, 2025 16:12:35.398770094 CET	192.168.2.15	8.8.8.8	0xf9e8	Standard query (0)	kittler.ru. [malformed]	256	483	false
Feb 11, 2025 16:12:37.039876938 CET	192.168.2.15	8.8.8.8	0x220f	Standard query (0)	kittler.ru. [malformed]	256	485	false
Feb 11, 2025 16:12:38.679390907 CET	192.168.2.15	8.8.8.8	0xb60a	Standard query (0)	newkittler.ru. [malformed]	256	486	false
Feb 11, 2025 16:12:40.299751043 CET	192.168.2.15	8.8.8.8	0x7762	Standard query (0)	mykittler.ru. [malformed]	256	488	false
Feb 11, 2025 16:12:41.931458950 CET	192.168.2.15	8.8.8.8	0x9f5c	Standard query (0)	kittler.ru. [malformed]	256	489	false
Feb 11, 2025 16:12:43.570569038 CET	192.168.2.15	8.8.8.8	0x1825	Standard query (0)	newkittler.ru. [malformed]	256	491	false
Feb 11, 2025 16:12:45.194226027 CET	192.168.2.15	8.8.8.8	0xccba	Standard query (0)	newkittler.ru. [malformed]	256	493	false
Feb 11, 2025 16:12:46.844865084 CET	192.168.2.15	8.8.8.8	0x57c7	Standard query (0)	thekittler.ru. [malformed]	256	494	false
Feb 11, 2025 16:12:48.495739937 CET	192.168.2.15	8.8.8.8	0xfa02	Standard query (0)	cat-are-here.ru	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:12:50.120734930 CET	192.168.2.15	8.8.8.8	0xec69	Standard query (0)	cat-are-here.ru	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:12:51.753489017 CET	192.168.2.15	8.8.8.8	0x4f66	Standard query (0)	gokittler.ru. [malformed]	256	499	false
Feb 11, 2025 16:12:53.370815039 CET	192.168.2.15	8.8.8.8	0xebfd	Standard query (0)	newkittler.ru	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:12:55.038650036 CET	192.168.2.15	8.8.8.8	0x4e25	Standard query (0)	cuttiecats.ru	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:12:56.671061993 CET	192.168.2.15	8.8.8.8	0xa56	Standard query (0)	newkittler.ru	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:12:58.344611883 CET	192.168.2.15	8.8.8.8	0xe694	Standard query (0)	qittler.ru. [malformed]	256	506	false
Feb 11, 2025 16:13:00.011724949 CET	192.168.2.15	8.8.8.8	0x5de2	Standard query (0)	kittlez.ru. [malformed]	256	508	false
Feb 11, 2025 16:13:01.657794952 CET	192.168.2.15	8.8.8.8	0x57a0	Standard query (0)	kittler.ru. [malformed]	256	509	false
Feb 11, 2025 16:13:03.279330969 CET	192.168.2.15	8.8.8.8	0x6bdc	Standard query (0)	thekittler.ru. [malformed]	256	511	false
Feb 11, 2025 16:13:04.913033009 CET	192.168.2.15	8.8.8.8	0x3262	Standard query (0)	mykittler.ru. [malformed]	256	256	false
Feb 11, 2025 16:13:06.532593012 CET	192.168.2.15	8.8.8.8	0x5a37	Standard query (0)	cuttiecats.ru	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:13:08.225224972 CET	192.168.2.15	8.8.8.8	0xf8f2	Standard query (0)	polizei.su. [malformed]	256	260	false
Feb 11, 2025 16:13:09.854046106 CET	192.168.2.15	8.8.8.8	0xff92	Standard query (0)	cats-master.ru	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:13:11.491152048 CET	192.168.2.15	8.8.8.8	0xfb99	Standard query (0)	polizei.su. [malformed]	256	263	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Feb 11, 2025 16:11:47.921910048 CET	8.8.8.8	192.168.2.15	0x786b	No error (0)	gokittler.ru	185.93.89.106	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:11:49.582978010 CET	8.8.8.8	192.168.2.15	0xecb8	No error (0)	cuttiecats.ru	185.93.89.106	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:11:52.855808973 CET	8.8.8.8	192.168.2.15	0x4ddf	No error (0)	thekittler.ru	185.93.89.106	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:11:56.125158072 CET	8.8.8.8	192.168.2.15	0x4850	No error (0)	cats-master.ru	185.93.89.106	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:12:01.034629107 CET	8.8.8.8	192.168.2.15	0xdb8	No error (0)	cat-are-here.ru	185.93.89.106	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:12:05.900285959 CET	8.8.8.8	192.168.2.15	0xbce3	No error (0)	kittlerer.ru	185.93.89.106	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:12:07.541709900 CET	8.8.8.8	192.168.2.15	0xf6a1	No error (0)	thekittler.ru	185.93.89.106	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:12:23.881412029 CET	8.8.8.8	192.168.2.15	0x970e	No error (0)	cats-master.ru	185.93.89.106	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:12:48.502688885 CET	8.8.8.8	192.168.2.15	0xfa02	No error (0)	cat-are-here.ru	185.93.89.106	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:12:50.131385088 CET	8.8.8.8	192.168.2.15	0xec69	No error (0)	cat-are-here.ru	185.93.89.106	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:12:53.385679960 CET	8.8.8.8	192.168.2.15	0xebfd	No error (0)	newkittler.ru	185.93.89.106	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:12:55.045886993 CET	8.8.8.8	192.168.2.15	0x4e25	No error (0)	cuttiecats.ru	185.93.89.106	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:12:56.724983931 CET	8.8.8.8	192.168.2.15	0xa56	No error (0)	newkittler.ru	185.93.89.106	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:13:06.586854935 CET	8.8.8.8	192.168.2.15	0x5a37	No error (0)	cuttiecats.ru	185.93.89.106	A (IP address)	IN (0x0001)	false
Feb 11, 2025 16:13:09.871417046 CET	8.8.8.8	192.168.2.15	0xff92	No error (0)	cats-master.ru	185.93.89.106	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: arm.elf PID: 5709, Parent PID: 5636

General

Start time (UTC):	15:11:46
Start date (UTC):	11/02/2025
Path:	/tmp/arm.elf
Arguments:	/tmp/arm.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

File Read

File Moved

Process Activities

Process Forked

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Listening

Socket Connecting

Chronological Activities

Analysis Process: arm.elf PID: 5711, Parent PID: 5709

General

Start time (UTC):	15:11:46
Start date (UTC):	11/02/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: arm.elf PID: 5713, Parent PID: 5711

General

Start time (UTC):	15:11:46
Start date (UTC):	11/02/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

File Read

Process Activities

Prctl Requested

Thread Sleep

Chronological Activities

Analysis Process: arm.elf PID: 5715, Parent PID: 5711

General

Start time (UTC):	15:11:47
Start date (UTC):	11/02/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Prctl Requested

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: arm.elf PID: 5716, Parent PID: 5711

General

Start time (UTC):	15:11:47
Start date (UTC):	11/02/2025
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

Directory Enumerated

Process Activities

Signal Sent

Prctl Requested

Thread Sleep

Chronological Activities

Analysis Process: xfce4-session PID: 5741, Parent PID: 3074

General

Start time (UTC):	15:11:47
Start date (UTC):	11/02/2025
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: gdm3 PID: 5742, Parent PID: 1333

General

Start time (UTC):	15:11:47
Start date (UTC):	11/02/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: Default PID: 5742, Parent PID: 1333

General

Start time (UTC):	15:11:47
Start date (UTC):	11/02/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: gdm3 PID: 5748, Parent PID: 1333

General

Start time (UTC):	15:11:47
Start date (UTC):	11/02/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: Default PID: 5748, Parent PID: 1333

General

Start time (UTC):	15:11:47
Start date (UTC):	11/02/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: xfce4-session PID: 5749, Parent PID: 3074

General

Start time (UTC):	15:11:47
Start date (UTC):	11/02/2025
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: xfce4-session PID: 5752, Parent PID: 3074

General

Start time (UTC):	15:11:47
Start date (UTC):	11/02/2025
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: xfce4-session PID: 5753, Parent PID: 3074

General

Start time (UTC):	15:11:47
Start date (UTC):	11/02/2025
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: xfdesktop PID: 5753, Parent PID: 3074

General

Start time (UTC):	15:11:47
Start date (UTC):	11/02/2025
Path:	/usr/bin/xfdesktop
Arguments:	xfdesktop --display :1.0 --sm-client-id 2975cc77d-4424-4c3b-abac-4708c6227ebe
File size:	473520 bytes
MD5 hash:	dfb13e1581f80065dcea16f2476f16f2

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: xfce4-session PID: 5755, Parent PID: 3074

General

Start time (UTC):	15:11:48
Start date (UTC):	11/02/2025
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: xfce4-panel PID: 5755, Parent PID: 3074

General

Start time (UTC):	15:11:48
Start date (UTC):	11/02/2025
Path:	/usr/bin/xfce4-panel
Arguments:	xfce4-panel --display :1.0 --sm-client-id 2231df6a5-9489-4681-813c-95be59ba41ad
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: xfce4-session PID: 5757, Parent PID: 3074

General

Start time (UTC):	15:11:48
Start date (UTC):	11/02/2025
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: xfwm4 PID: 5757, Parent PID: 3074

General

Start time (UTC):	15:11:48
Start date (UTC):	11/02/2025
Path:	/usr/bin/xfwm4
Arguments:	xfwm4 --display :1.0 --sm-client-id 25b39293a-fee6-4e14-94fe-6ac0d9644afd
File size:	420424 bytes
MD5 hash:	59defa3c00cc30d85ed77b738d55e9da

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: xfce4-session PID: 5759, Parent PID: 3074

General

Start time (UTC):	15:11:48
Start date (UTC):	11/02/2025
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: xfdesktop PID: 5759, Parent PID: 3074

General

Start time (UTC):	15:11:48
Start date (UTC):	11/02/2025
Path:	/usr/bin/xfdesktop
Arguments:	xfdesktop --display :1.0 --sm-client-id 2975cc77d-4424-4c3b-abac-4708c6227ebe
File size:	473520 bytes
MD5 hash:	dfb13e1581f80065dcea16f2476f16f2

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: xfce4-session PID: 5760, Parent PID: 3074

General

Start time (UTC):	15:11:48
Start date (UTC):	11/02/2025
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: xfce4-session PID: 5761, Parent PID: 3074

General

Start time (UTC):	15:11:48
Start date (UTC):	11/02/2025
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: xfce4-panel PID: 5761, Parent PID: 3074

General

Start time (UTC):	15:11:48
Start date (UTC):	11/02/2025
Path:	/usr/bin/xfce4-panel
Arguments:	xfce4-panel --display :1.0 --sm-client-id 2231df6a5-9489-4681-813c-95be59ba41ad
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: xfce4-session PID: 5762, Parent PID: 3074

General

Start time (UTC):	15:11:48
Start date (UTC):	11/02/2025
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: xfce4-session PID: 5763, Parent PID: 3074

General

Start time (UTC):	15:11:48
Start date (UTC):	11/02/2025
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: xfwm4 PID: 5763, Parent PID: 3074

General

Start time (UTC):	15:11:48
Start date (UTC):	11/02/2025
Path:	/usr/bin/xfwm4
Arguments:	xfwm4 --display :1.0 --sm-client-id 25b39293a-fee6-4e14-94fe-6ac0d9644afd
File size:	420424 bytes
MD5 hash:	59defa3c00cc30d85ed77b738d55e9da

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: xfce4-session PID: 5765, Parent PID: 3074

General

Start time (UTC):	15:11:48
Start date (UTC):	11/02/2025
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: xfdesktop PID: 5765, Parent PID: 3074

General

Start time (UTC):	15:11:48
Start date (UTC):	11/02/2025
Path:	/usr/bin/xfdesktop
Arguments:	xfdesktop --display :1.0 --sm-client-id 2975cc77d-4424-4c3b-abac-4708c6227ebe
File size:	473520 bytes
MD5 hash:	dfb13e1581f80065dcea16f2476f16f2

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: systemd PID: 5768, Parent PID: 1

General

Start time (UTC):	15:11:57
Start date (UTC):	11/02/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: systemd-user-runtime-dir PID: 5768, Parent PID: 1

General

Start time (UTC):	15:11:57
Start date (UTC):	11/02/2025
Path:	/lib/systemd/systemd-user-runtime-dir
Arguments:	/lib/systemd/systemd-user-runtime-dir stop 127
File size:	22672 bytes
MD5 hash:	d55f4b0847f88131dbcfb07435178e54

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report arm.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: arm.elf PID: 5709, Parent PID: 5636

General

File Activities

File Opened

File Read

File Moved

Process Activities

Process Forked

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Listening

Socket Connecting

Chronological Activities

Analysis Process: arm.elf PID: 5711, Parent PID: 5709

General

Process Activities

Process Forked

Linux Analysis Report
arm.elf