Edit tour

Linux Analysis Report
x86_32.nn.elf

Overview

General Information

Sample name:	x86_32.nn.elf
Analysis ID:	1628915
MD5:	043823a070b59144403d9f8e41de70b3
SHA1:	37ca5eb522cbdeb24169e919a96c0cfca70ba11e
SHA256:	ff2bc3fa6109328921c5792d0ecd5ae0d3e1e302a1cfe67439c09c8e3a73e2f5
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	64
Range:	0 - 100

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Sample has stripped symbol table

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1628915
Start date and time:	2025-03-04 09:23:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	x86_32.nn.elf
Detection:	MAL
Classification:	mal64.troj.linELF@0/1@0/0

Runtime Messages

Command:	/tmp/x86_32.nn.elf
PID:	6213
Exit Code:	139
Exit Code Info:	SIGSEGV (11) Segmentation fault invalid memory reference
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6203, Parent: 4331)

rm (PID: 6203, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.reaLdyPxME /tmp/tmp.YJouaAPuE7 /tmp/tmp.InV1bB0OXq

dash New Fork (PID: 6204, Parent: 4331)

rm (PID: 6204, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.reaLdyPxME /tmp/tmp.YJouaAPuE7 /tmp/tmp.InV1bB0OXq

x86_32.nn.elf (PID: 6213, Parent: 6128, MD5: 043823a070b59144403d9f8e41de70b3) Arguments: /tmp/x86_32.nn.elf

x86_32.nn.elf New Fork (PID: 6229, Parent: 6213)

x86_32.nn.elf New Fork (PID: 6232, Parent: 6229)

udisksd New Fork (PID: 6222, Parent: 799)

dumpe2fs (PID: 6222, Parent: 799, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

udisksd New Fork (PID: 6260, Parent: 799)

dumpe2fs (PID: 6260, Parent: 799, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
x86_32.nn.elf	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
x86_32.nn.elf	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0x10d86:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
x86_32.nn.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x7b50:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
x86_32.nn.elf	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x1195a:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
x86_32.nn.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xcd22:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
x86_32.nn.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x109dc:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
x86_32.nn.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xee58:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
x86_32.nn.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xccf2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6213.1.0000000008048000.000000000805e000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6213.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0x10d86:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
6213.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x7b50:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6213.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x1195a:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
6213.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xcd22:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6213.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x109dc:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6213.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xee58:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6213.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xccf2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 3 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Persistence and Installation Behavior
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: x86_32.nn.elf	Virustotal: Detection: 24%			Perma Link
Source: x86_32.nn.elf	ReversingLabs: Detection: 28%

Source: global traffic

TCP traffic: 192.168.2.23:58492 -> 176.65.134.15:38242

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6213.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 6213.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6213.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 6213.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6213.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6213.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6213.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown

Source: ELF static info symbol of initial sample

.symtab present: no

Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: x86_32.nn.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6213.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 6213.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6213.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 6213.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6213.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6213.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6213.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26

Source: classification engine

Classification label: mal64.troj.linELF@0/1@0/0

Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6311/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6233/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6310/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6313/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6312/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6290/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6292/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6291/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6293/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6306/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6305/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6308/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6307/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6309/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/4480/cmdline	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6241/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6240/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6243/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6320/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6242/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6245/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6289/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6244/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6246/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6238/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6315/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6237/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6039/cmdline	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6314/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6317/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6239/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6316/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6319/status	Jump to behavior
Source: /tmp/x86_32.nn.elf (PID: 6232)	File opened: /proc/6318/status	Jump to behavior

Source: /usr/bin/dash (PID: 6203)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.reaLdyPxME /tmp/tmp.YJouaAPuE7 /tmp/tmp.InV1bB0OXq			Jump to behavior
Source: /usr/bin/dash (PID: 6204)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.reaLdyPxME /tmp/tmp.YJouaAPuE7 /tmp/tmp.InV1bB0OXq			Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: x86_32.nn.elf, type: SAMPLE
Source: Yara match	File source: 6213.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: x86_32.nn.elf, type: SAMPLE
Source: Yara match	File source: 6213.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
x86_32.nn.elf	25%	Virustotal		Browse
x86_32.nn.elf	29%	ReversingLabs	Linux.Backdoor.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
176.65.134.15	unknown	Germany	56325	DIOGELO-ASGB	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
176.65.134.15	x86_64.nn.elf	Get hash	malicious	Mirai	Browse
	sparc.nn.elf	Get hash	malicious	Mirai	Browse
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse
	powerpc.nn.elf	Get hash	malicious	Mirai	Browse
	mipsel.nn.elf	Get hash	malicious	Mirai	Browse
	x86_32.nn.elf	Get hash	malicious	Mirai	Browse
	mipsel.nn.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	x86_32.nn.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	powerpc.nn.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	x86_64.nn.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
91.189.91.43	sparc.nn.elf	Get hash	malicious	Mirai	Browse
	m68k.nn.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	x86.elf	Get hash	malicious	Mirai	Browse
	m68k.elf	Get hash	malicious	Unknown	Browse
	m68k.nn.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	sparc.nn.elf	Get hash	malicious	Mirai	Browse
	m68k.nn.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	x86.elf	Get hash	malicious	Mirai	Browse
	m68k.elf	Get hash	malicious	Unknown	Browse
	m68k.nn.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	sparc.nn.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	m68k.nn.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	m68k.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	m68k.nn.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CANONICAL-ASGB	sparc.nn.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	m68k.nn.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	m68k.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	m68k.nn.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
DIOGELO-ASGB	x86_64.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	sparc.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	powerpc.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	mipsel.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	x86_32.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	mipsel.nn.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	176.65.134.15
	x86_32.nn.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	176.65.134.15
	powerpc.nn.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	176.65.134.15
	x86_64.nn.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	176.65.134.15
INIT7CH	sparc.nn.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	m68k.nn.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	x86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	m68k.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	m68k.nn.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/etc/motd

Download File

Process:	/tmp/x86_32.nn.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	53
Entropy (8bit):	3.871459242626451
Encrypted:	false
SSDEEP:	3:yGKtARxFQFrgBJ4BJ+3e:dQ0EcHG2e
MD5:	2BD9B4BE30579E633FC0191AA93DF486
SHA1:	7D63A9BD9662E86666B27C1B50DB8E7370C624FF
SHA-256:	64DC39F3004DC93C9FC4F1467B4807F2D8E3EB0BFA96B15C19CD8E7D6FA77A1D
SHA-512:	AE6DD7B39191354CF43CF65E517460D7D4C61B8F5C08E33E6CA3C451DC7CAB4DE89F33934C89396B80F1AADE0A4E2571BD5AE8B76EF80B737D4588703D2814D5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	gorilla botnet is on the device ur not a cat go away.

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.4783761344788315
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	x86_32.nn.elf
File size:	91'696 bytes
MD5:	043823a070b59144403d9f8e41de70b3
SHA1:	37ca5eb522cbdeb24169e919a96c0cfca70ba11e
SHA256:	ff2bc3fa6109328921c5792d0ecd5ae0d3e1e302a1cfe67439c09c8e3a73e2f5
SHA512:	e363b6ba10a3af2614621d5d7abaa5cd156a6591c2c992531db8e3fe5ef2847a51820ffc820e64c9e1b8357debce671f18111940b0c68844cc5ef248f6219e8d
SSDEEP:	1536:UGUD86rB2VBn4YKQh/FPHJrnMc9PndCHQsZmoXo11pUrTu1Jbwkcoxk+S3Ho5ee+:KDhrB2jn4YlPHJrnMc9OF4DpIOJb59L8
TLSH:	8E935BC0E983E5F5DD0102B11177B73BDB72EA790139DB47E7A8AA36A853202E74135C
File Content Preview:	.ELF....................d...4....d......4. ...(......................\...\...............`..........`....m..........Q.td............................U..S.......w_...h.....=..[]...$.............U......=`....t..5....$......$.......u........t....h............

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	91296
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0x13d26	0x0	0x6	AX	16
.fini	PROGBITS	0x805bdd6	0x13dd6	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x805be00	0x13e00	0x1ea0	0x0	0x2	A	32
.ctors	PROGBITS	0x805e000	0x16000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x805e008	0x16008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x805e020	0x16020	0x440	0x0	0x3	WA	32
.bss	NOBITS	0x805e460	0x16460	0x6924	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x16460	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x15ca0	0x15ca0	6.5303	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x16000	0x805e000	0x805e000	0x460	0x6d84	5.1822	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 422
• 38242 undefined
• 443 (HTTPS)
• 80 (HTTP)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 4, 2025 09:24:36.136394024 CET	58492	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:36.141755104 CET	38242	58492	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:36.141835928 CET	58492	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:36.141885042 CET	58492	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:36.147011042 CET	38242	58492	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:36.649456024 CET	58492	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:36.700768948 CET	38242	58492	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:37.546996117 CET	43928	443	192.168.2.23	91.189.91.42
Mar 4, 2025 09:24:37.651530027 CET	58494	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:37.657488108 CET	38242	58494	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:37.657592058 CET	58494	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:37.657593012 CET	58494	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:37.663611889 CET	38242	58494	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:38.171387911 CET	58494	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:38.220632076 CET	38242	58494	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:39.174300909 CET	58496	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:39.180656910 CET	38242	58496	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:39.180749893 CET	58496	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:39.180749893 CET	58496	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:39.186906099 CET	38242	58496	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:39.691159964 CET	58496	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:39.740616083 CET	38242	58496	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:39.761472940 CET	38242	58492	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:39.761590958 CET	58492	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:40.692229986 CET	58498	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:40.697483063 CET	38242	58498	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:40.697637081 CET	58498	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:40.697637081 CET	58498	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:40.702738047 CET	38242	58498	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:41.201610088 CET	58498	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:41.249444962 CET	38242	58498	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:41.281857967 CET	38242	58494	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:41.281971931 CET	58494	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:41.298566103 CET	38242	58498	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:41.298619986 CET	58498	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:42.202704906 CET	58500	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:42.209281921 CET	38242	58500	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:42.209367037 CET	58500	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:42.209402084 CET	58500	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:42.215542078 CET	38242	58500	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:42.715771914 CET	58500	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:42.769577026 CET	38242	58500	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:42.829392910 CET	38242	58496	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:42.829586983 CET	58496	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:42.922262907 CET	42836	443	192.168.2.23	91.189.91.43
Mar 4, 2025 09:24:43.716515064 CET	58502	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:43.721755981 CET	38242	58502	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:43.721864939 CET	58502	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:43.721864939 CET	58502	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:43.727005959 CET	38242	58502	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:43.946130037 CET	42516	80	192.168.2.23	109.202.202.202
Mar 4, 2025 09:24:44.226761103 CET	58502	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:44.277121067 CET	38242	58502	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:45.227360964 CET	58504	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:45.232603073 CET	38242	58504	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:45.232750893 CET	58504	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:45.232750893 CET	58504	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:45.237880945 CET	38242	58504	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:45.736534119 CET	58504	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:45.784655094 CET	38242	58504	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:45.871917009 CET	38242	58504	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:45.872004986 CET	58504	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:46.737265110 CET	58506	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:46.742609024 CET	38242	58506	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:46.742736101 CET	58506	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:46.742772102 CET	58506	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:46.747833967 CET	38242	58506	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:47.247694969 CET	58506	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:47.303200006 CET	38242	58506	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:47.347284079 CET	38242	58506	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:47.347410917 CET	58506	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:48.248564005 CET	58508	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:48.253829002 CET	38242	58508	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:48.253935099 CET	58508	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:48.253935099 CET	58508	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:48.259026051 CET	38242	58508	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:48.759452105 CET	58508	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:48.812617064 CET	38242	58508	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:48.848148108 CET	38242	58508	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:48.848221064 CET	58508	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:49.760359049 CET	58510	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:49.765671968 CET	38242	58510	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:49.765765905 CET	58510	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:49.765765905 CET	58510	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:49.770972013 CET	38242	58510	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:50.270967960 CET	58510	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:50.320727110 CET	38242	58510	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:50.391170979 CET	38242	58510	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:50.391269922 CET	58510	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:51.277520895 CET	58512	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:51.282767057 CET	38242	58512	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:51.282840967 CET	58512	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:51.282840967 CET	58512	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:51.287985086 CET	38242	58512	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:51.789396048 CET	58512	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:51.840529919 CET	38242	58512	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:51.903709888 CET	38242	58512	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:51.903961897 CET	58512	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:52.790255070 CET	58514	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:52.795548916 CET	38242	58514	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:52.795660019 CET	58514	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:52.795721054 CET	58514	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:52.801152945 CET	38242	58514	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:53.301239967 CET	58514	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:53.343859911 CET	38242	58502	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:53.343983889 CET	58502	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:53.348561049 CET	38242	58514	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:53.400664091 CET	38242	58514	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:53.400774002 CET	58514	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:54.301934958 CET	58516	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:54.307137012 CET	38242	58516	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:54.307198048 CET	58516	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:54.307218075 CET	58516	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:54.312335014 CET	38242	58516	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:54.811326027 CET	58516	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:54.856489897 CET	38242	58516	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:54.917406082 CET	38242	58516	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:54.917583942 CET	58516	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:55.811830044 CET	58518	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:55.820924044 CET	38242	58518	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:55.820991993 CET	58518	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:55.820991993 CET	58518	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:55.830199957 CET	38242	58518	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:56.324156046 CET	58518	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:56.372529030 CET	38242	58518	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:56.418642998 CET	38242	58518	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:56.418730974 CET	58518	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:57.324709892 CET	58520	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:57.330039024 CET	38242	58520	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:57.330123901 CET	58520	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:57.330123901 CET	58520	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:57.335280895 CET	38242	58520	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:57.768100023 CET	43928	443	192.168.2.23	91.189.91.42
Mar 4, 2025 09:24:57.833194017 CET	58520	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:57.884455919 CET	38242	58520	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:57.968842030 CET	38242	58520	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:57.968966007 CET	58520	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:58.833695889 CET	58522	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:58.839030981 CET	38242	58522	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:58.839106083 CET	58522	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:58.839106083 CET	58522	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:58.844268084 CET	38242	58522	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:59.344753027 CET	58522	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:24:59.396477938 CET	38242	58522	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:59.443589926 CET	38242	58522	176.65.134.15	192.168.2.23
Mar 4, 2025 09:24:59.443659067 CET	58522	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:00.345791101 CET	58524	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:00.351083994 CET	38242	58524	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:00.351146936 CET	58524	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:00.351180077 CET	58524	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:00.356298923 CET	38242	58524	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:00.857953072 CET	58524	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:00.904668093 CET	38242	58524	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:00.971785069 CET	38242	58524	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:00.971849918 CET	58524	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:01.859180927 CET	58526	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:01.865128040 CET	38242	58526	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:01.865187883 CET	58526	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:01.865217924 CET	58526	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:01.870239973 CET	38242	58526	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:02.370091915 CET	58526	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:02.420418978 CET	38242	58526	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:02.485649109 CET	38242	58526	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:02.485809088 CET	58526	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:03.370733976 CET	58528	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:03.376708984 CET	38242	58528	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:03.376780987 CET	58528	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:03.376822948 CET	58528	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:03.381923914 CET	38242	58528	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:03.582139015 CET	38242	58500	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:03.582221031 CET	58500	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:03.880388021 CET	58528	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:03.932496071 CET	38242	58528	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:04.005934954 CET	38242	58528	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:04.006016970 CET	58528	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:04.881053925 CET	58530	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:04.886358023 CET	38242	58530	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:04.886444092 CET	58530	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:04.886480093 CET	58530	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:04.891638041 CET	38242	58530	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:05.392225027 CET	58530	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:05.440388918 CET	38242	58530	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:06.393671989 CET	58532	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:06.400665998 CET	38242	58532	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:06.400728941 CET	58532	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:06.400767088 CET	58532	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:06.407938004 CET	38242	58532	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:06.905818939 CET	58532	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:06.952379942 CET	38242	58532	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:07.906753063 CET	58534	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:07.913029909 CET	38242	58534	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:07.913099051 CET	58534	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:07.913130999 CET	58534	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:07.918164015 CET	38242	58534	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:08.416949987 CET	58534	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:08.468359947 CET	38242	58534	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:08.512514114 CET	38242	58534	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:08.512583971 CET	58534	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:09.417921066 CET	58536	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:09.423958063 CET	38242	58536	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:09.424042940 CET	58536	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:09.424082041 CET	58536	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:09.429487944 CET	38242	58536	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:09.928915977 CET	58536	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:09.980348110 CET	38242	58536	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:10.022821903 CET	38242	58536	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:10.022896051 CET	58536	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:10.054290056 CET	42836	443	192.168.2.23	91.189.91.43
Mar 4, 2025 09:25:10.929558039 CET	58538	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:10.934712887 CET	38242	58538	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:10.934803963 CET	58538	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:10.934863091 CET	58538	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:10.939877033 CET	38242	58538	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:11.439564943 CET	58538	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:11.492337942 CET	38242	58538	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:11.530843973 CET	38242	58538	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:11.530915976 CET	58538	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:12.440510988 CET	58540	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:12.448704004 CET	38242	58540	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:12.448818922 CET	58540	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:12.448834896 CET	58540	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:12.456254005 CET	38242	58540	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:12.955389977 CET	58540	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:13.006321907 CET	38242	58540	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:13.052671909 CET	38242	58540	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:13.052773952 CET	58540	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:13.956393003 CET	58542	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:13.961790085 CET	38242	58542	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:13.961870909 CET	58542	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:13.961889982 CET	58542	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:13.967822075 CET	38242	58542	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:14.149667025 CET	42516	80	192.168.2.23	109.202.202.202
Mar 4, 2025 09:25:14.466280937 CET	58542	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:14.520308018 CET	38242	58542	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:14.559895039 CET	38242	58542	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:14.559957981 CET	58542	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:15.467113972 CET	58544	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:15.472239017 CET	38242	58544	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:15.472341061 CET	58544	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:15.472383976 CET	58544	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:15.477351904 CET	38242	58544	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:15.977356911 CET	58544	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:16.024338007 CET	38242	58544	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:16.075438976 CET	38242	58532	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:16.075527906 CET	58532	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:16.099999905 CET	38242	58544	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:16.100116968 CET	58544	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:16.978223085 CET	58546	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:16.983334064 CET	38242	58546	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:16.983426094 CET	58546	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:16.983493090 CET	58546	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:16.988765001 CET	38242	58546	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:17.488801003 CET	58546	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:17.536552906 CET	38242	58546	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:17.581747055 CET	38242	58546	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:17.581837893 CET	58546	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:18.489995956 CET	58548	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:18.497071981 CET	38242	58548	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:18.497173071 CET	58548	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:18.497237921 CET	58548	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:18.503895044 CET	38242	58548	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:19.003241062 CET	58548	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:19.052268028 CET	38242	58548	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:19.117007971 CET	38242	58548	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:19.117181063 CET	58548	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:20.004323959 CET	58550	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:20.009455919 CET	38242	58550	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:20.009527922 CET	58550	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:20.009527922 CET	58550	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:20.014643908 CET	38242	58550	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:20.514010906 CET	58550	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:20.564225912 CET	38242	58550	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:20.614742994 CET	38242	58550	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:20.614826918 CET	58550	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:21.514657021 CET	58552	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:21.520246983 CET	38242	58552	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:21.520324945 CET	58552	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:21.520325899 CET	58552	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:21.526021957 CET	38242	58552	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:22.024111032 CET	58552	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:22.072216988 CET	38242	58552	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:22.129479885 CET	38242	58552	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:22.129559040 CET	58552	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:23.025170088 CET	58554	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:23.030328035 CET	38242	58554	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:23.030407906 CET	58554	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:23.030407906 CET	58554	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:23.035480022 CET	38242	58554	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:23.534569025 CET	58554	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:23.580286026 CET	38242	58554	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:23.635596991 CET	38242	58554	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:23.635664940 CET	58554	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:24.535289049 CET	58556	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:24.540923119 CET	38242	58556	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:24.540992022 CET	58556	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:24.541037083 CET	58556	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:24.547203064 CET	38242	58556	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:25.045037031 CET	58556	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:25.092226982 CET	38242	58556	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:25.153008938 CET	38242	58556	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:25.153090000 CET	58556	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:26.045814037 CET	58558	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:26.052828074 CET	38242	58558	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:26.052937031 CET	58558	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:26.052977085 CET	58558	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:26.058000088 CET	38242	58558	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:26.269663095 CET	38242	58530	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:26.269762039 CET	58530	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:26.557163000 CET	58558	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:26.604917049 CET	38242	58558	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:26.669904947 CET	38242	58558	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:26.670001030 CET	58558	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:27.557790041 CET	58560	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:27.564521074 CET	38242	58560	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:27.564640045 CET	58560	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:27.564640045 CET	58560	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:27.571851969 CET	38242	58560	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:28.068136930 CET	58560	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:28.122807026 CET	38242	58560	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:29.068784952 CET	58562	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:29.073909998 CET	38242	58562	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:29.073986053 CET	58562	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:29.074002981 CET	58562	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:29.079479933 CET	38242	58562	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:29.581231117 CET	58562	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:29.628149986 CET	38242	58562	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:30.582036018 CET	58564	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:30.587191105 CET	38242	58564	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:30.587346077 CET	58564	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:30.587347031 CET	58564	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:30.592511892 CET	38242	58564	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:31.090806007 CET	58564	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:31.143986940 CET	38242	58564	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:31.205104113 CET	38242	58564	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:31.205216885 CET	58564	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:32.091746092 CET	58566	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:32.098737001 CET	38242	58566	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:32.099025965 CET	58566	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:32.099066973 CET	58566	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:32.105855942 CET	38242	58566	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:32.603504896 CET	58566	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:32.652153969 CET	38242	58566	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:32.711806059 CET	38242	58566	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:32.711873055 CET	58566	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:33.604541063 CET	58568	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:33.610733986 CET	38242	58568	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:33.610853910 CET	58568	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:33.610954046 CET	58568	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:33.616065025 CET	38242	58568	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:34.116547108 CET	58568	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:34.164180994 CET	38242	58568	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:34.226465940 CET	38242	58568	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:34.226644993 CET	58568	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:35.117561102 CET	58570	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:35.122632027 CET	38242	58570	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:35.122745037 CET	58570	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:35.122760057 CET	58570	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:35.127726078 CET	38242	58570	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:35.627351046 CET	58570	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:35.676120043 CET	38242	58570	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:35.727168083 CET	38242	58570	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:35.727391005 CET	58570	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:36.628583908 CET	58572	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:36.633986950 CET	38242	58572	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:36.634078979 CET	58572	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:36.634150982 CET	58572	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:36.639714956 CET	38242	58572	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:37.140818119 CET	58572	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:37.181576014 CET	38242	58560	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:37.181830883 CET	58560	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:37.188591957 CET	38242	58572	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:37.234610081 CET	38242	58572	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:37.234704018 CET	58572	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:38.142337084 CET	58574	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:38.148941040 CET	38242	58574	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:38.149173021 CET	58574	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:38.149218082 CET	58574	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:38.154592037 CET	38242	58574	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:38.654608011 CET	58574	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:38.704129934 CET	38242	58574	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:38.722209930 CET	43928	443	192.168.2.23	91.189.91.42
Mar 4, 2025 09:25:38.749913931 CET	38242	58574	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:38.750118017 CET	58574	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:39.656014919 CET	58576	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:39.663994074 CET	38242	58576	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:39.664123058 CET	58576	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:39.664170980 CET	58576	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:39.671977043 CET	38242	58576	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:40.177814960 CET	58576	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:40.229943991 CET	38242	58576	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:41.179476976 CET	58578	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:41.184866905 CET	38242	58578	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:41.184937000 CET	58578	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:41.184973955 CET	58578	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:41.190165997 CET	38242	58578	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:41.691450119 CET	58578	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:41.744508028 CET	38242	58578	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:42.693057060 CET	58580	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:42.698334932 CET	38242	58580	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:42.698420048 CET	58580	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:42.698477983 CET	58580	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:42.703531981 CET	38242	58580	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:43.206027985 CET	58580	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:43.252315044 CET	38242	58580	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:43.312622070 CET	38242	58576	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:43.312716961 CET	58576	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:44.207530975 CET	58582	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:44.212896109 CET	38242	58582	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:44.212979078 CET	58582	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:44.213046074 CET	58582	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:44.219063044 CET	38242	58582	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:44.720371962 CET	58582	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:44.768090010 CET	38242	58582	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:44.817373991 CET	38242	58582	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:44.817481995 CET	58582	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:44.821718931 CET	38242	58578	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:44.821907043 CET	58578	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:45.722281933 CET	58584	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:45.727487087 CET	38242	58584	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:45.727571964 CET	58584	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:45.727622986 CET	58584	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:45.732682943 CET	38242	58584	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:46.235460043 CET	58584	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:46.288052082 CET	38242	58584	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:46.307920933 CET	38242	58580	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:46.308015108 CET	58580	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:46.324928045 CET	38242	58584	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:46.325011015 CET	58584	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:47.237148046 CET	58586	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:47.242289066 CET	38242	58586	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:47.242386103 CET	58586	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:47.242386103 CET	58586	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:47.247433901 CET	38242	58586	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:47.749249935 CET	58586	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:47.796045065 CET	38242	58586	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:47.845176935 CET	38242	58586	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:47.845447063 CET	58586	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:48.750972033 CET	58588	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:48.756105900 CET	38242	58588	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:48.756242990 CET	58588	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:48.756297112 CET	58588	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:48.761327982 CET	38242	58588	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:49.265034914 CET	58588	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:49.316483974 CET	38242	58588	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:49.357640982 CET	38242	58588	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:49.357778072 CET	58588	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:50.266745090 CET	58590	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:50.272001028 CET	38242	58590	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:50.272089005 CET	58590	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:50.272089005 CET	58590	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:50.277199030 CET	38242	58590	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:50.457478046 CET	38242	58562	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:50.457631111 CET	58562	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:50.779305935 CET	58590	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:50.828021049 CET	38242	58590	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:51.780755043 CET	58592	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:51.785943031 CET	38242	58592	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:51.786041021 CET	58592	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:51.786066055 CET	58592	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:51.791122913 CET	38242	58592	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:52.293869019 CET	58592	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:52.343966961 CET	38242	58592	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:53.295691967 CET	58594	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:53.300981998 CET	38242	58594	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:53.301165104 CET	58594	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:53.301219940 CET	58594	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:53.306337118 CET	38242	58594	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:53.810399055 CET	58594	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:53.860492945 CET	38242	58594	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:53.900135994 CET	38242	58594	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:53.900239944 CET	58594	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:54.812139034 CET	58596	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:54.817265034 CET	38242	58596	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:54.817400932 CET	58596	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:54.817419052 CET	58596	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:54.822802067 CET	38242	58596	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:55.326839924 CET	58596	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:55.375932932 CET	38242	58596	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:55.430839062 CET	38242	58596	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:55.430943012 CET	58596	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:56.328248024 CET	58598	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:56.334373951 CET	38242	58598	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:56.334521055 CET	58598	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:56.334552050 CET	58598	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:56.340365887 CET	38242	58598	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:56.840857983 CET	58598	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:56.891973972 CET	38242	58598	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:57.842437983 CET	58600	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:57.847732067 CET	38242	58600	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:57.847870111 CET	58600	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:57.847870111 CET	58600	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:57.853004932 CET	38242	58600	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:58.355736017 CET	58600	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:58.403897047 CET	38242	58600	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:58.447578907 CET	38242	58600	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:58.447762966 CET	58600	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:59.357681036 CET	58602	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:59.362838030 CET	38242	58602	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:59.363090992 CET	58602	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:59.363090992 CET	58602	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:59.368248940 CET	38242	58602	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:59.871228933 CET	58602	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:25:59.923943043 CET	38242	58602	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:59.958116055 CET	38242	58602	176.65.134.15	192.168.2.23
Mar 4, 2025 09:25:59.958214998 CET	58602	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:00.873059988 CET	58604	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:00.878390074 CET	38242	58604	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:00.878519058 CET	58604	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:00.878555059 CET	58604	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:00.884021044 CET	38242	58604	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:01.391269922 CET	58604	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:01.404504061 CET	38242	58592	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:01.404628038 CET	58592	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:01.439852953 CET	38242	58604	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:01.492481947 CET	38242	58604	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:01.492610931 CET	58604	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:02.393407106 CET	58606	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:02.398638964 CET	38242	58606	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:02.398751020 CET	58606	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:02.398792028 CET	58606	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:02.403883934 CET	38242	58606	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:02.908689022 CET	58606	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:02.955848932 CET	38242	58606	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:02.999481916 CET	38242	58606	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:02.999563932 CET	58606	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:03.910834074 CET	58608	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:03.915927887 CET	38242	58608	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:03.915998936 CET	58608	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:03.916054964 CET	58608	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:03.921066046 CET	38242	58608	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:04.427122116 CET	58608	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:04.475969076 CET	38242	58608	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:05.429559946 CET	58610	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:05.434737921 CET	38242	58610	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:05.434811115 CET	58610	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:05.434860945 CET	58610	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:05.439966917 CET	38242	58610	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:05.943697929 CET	58610	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:05.991838932 CET	38242	58610	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:06.040456057 CET	38242	58610	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:06.040568113 CET	58610	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:06.945696115 CET	58612	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:06.950895071 CET	38242	58612	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:06.950994015 CET	58612	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:06.951045036 CET	58612	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:06.956024885 CET	38242	58612	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:07.459568024 CET	58612	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:07.511965036 CET	38242	58612	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:07.564060926 CET	38242	58612	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:07.564215899 CET	58612	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:08.461602926 CET	58614	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:08.468282938 CET	38242	58614	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:08.468379974 CET	58614	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:08.468467951 CET	58614	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:08.473485947 CET	38242	58614	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:08.977718115 CET	58614	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:09.023801088 CET	38242	58614	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:09.072379112 CET	38242	58614	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:09.072444916 CET	58614	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:09.979377031 CET	58616	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:09.984476089 CET	38242	58616	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:09.984545946 CET	58616	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:09.984590054 CET	58616	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:09.990658045 CET	38242	58616	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:10.494055986 CET	58616	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:10.543781996 CET	38242	58616	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:10.607840061 CET	38242	58616	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:10.607949972 CET	58616	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:11.496072054 CET	58618	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:11.501261950 CET	38242	58618	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:11.501312971 CET	58618	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:11.501329899 CET	58618	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:11.506470919 CET	38242	58618	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:11.633450985 CET	38242	58590	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:11.633548975 CET	58590	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:12.008660078 CET	58618	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:12.055751085 CET	38242	58618	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:13.010370016 CET	58620	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:13.015402079 CET	38242	58620	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:13.015486002 CET	58620	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:13.015546083 CET	58620	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:13.020597935 CET	38242	58620	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:13.523281097 CET	58620	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:13.529640913 CET	38242	58608	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:13.529736996 CET	58608	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:13.571770906 CET	38242	58620	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:14.524673939 CET	58622	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:14.531508923 CET	38242	58622	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:14.531584978 CET	58622	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:14.531641960 CET	58622	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:14.536894083 CET	38242	58622	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:15.038151979 CET	58622	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:15.083895922 CET	38242	58622	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:16.039666891 CET	58624	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:16.044830084 CET	38242	58624	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:16.044930935 CET	58624	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:16.045021057 CET	58624	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:16.050024033 CET	38242	58624	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:16.549938917 CET	58624	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:16.596647024 CET	38242	58624	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:16.650405884 CET	38242	58624	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:16.650629997 CET	58624	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:17.551271915 CET	58626	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:17.556495905 CET	38242	58626	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:17.556586981 CET	58626	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:17.556662083 CET	58626	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:17.561675072 CET	38242	58626	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:17.690233946 CET	38242	58598	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:17.690304995 CET	58598	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:18.062788010 CET	58626	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:18.111778975 CET	38242	58626	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:18.166948080 CET	38242	58626	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:18.167036057 CET	58626	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:19.063817978 CET	58628	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:19.069055080 CET	38242	58628	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:19.069246054 CET	58628	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:19.069246054 CET	58628	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:19.074364901 CET	38242	58628	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:19.575658083 CET	58628	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:19.627784967 CET	38242	58628	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:19.682857037 CET	38242	58628	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:19.682966948 CET	58628	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:20.577385902 CET	58630	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:20.582676888 CET	38242	58630	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:20.582779884 CET	58630	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:20.582815886 CET	58630	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:20.587877989 CET	38242	58630	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:21.090729952 CET	58630	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:21.122917891 CET	38242	58618	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:21.123127937 CET	58618	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:21.139745951 CET	38242	58630	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:22.092236996 CET	58632	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:22.097395897 CET	38242	58632	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:22.097517014 CET	58632	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:22.097536087 CET	58632	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:22.102622986 CET	38242	58632	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:22.604501009 CET	58632	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:22.773478985 CET	38242	58632	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:22.773581982 CET	58632	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:23.605959892 CET	58634	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:23.611736059 CET	38242	58634	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:23.611838102 CET	58634	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:23.611838102 CET	58634	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:23.619183064 CET	38242	58634	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:24.117347002 CET	58634	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:24.156488895 CET	38242	58622	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:24.156579018 CET	58622	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:24.163755894 CET	38242	58634	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:24.231050014 CET	38242	58634	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:24.231220007 CET	58634	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:25.118829966 CET	58636	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:25.124017954 CET	38242	58636	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:25.124142885 CET	58636	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:25.124188900 CET	58636	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:25.129246950 CET	38242	58636	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:25.631134987 CET	58636	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:25.679658890 CET	38242	58636	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:25.783081055 CET	38242	58636	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:25.783174038 CET	58636	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:26.633124113 CET	58638	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:26.638166904 CET	38242	58638	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:26.638349056 CET	58638	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:26.638375998 CET	58638	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:26.643356085 CET	38242	58638	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:27.145442009 CET	58638	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:27.195914030 CET	38242	58638	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:27.264729977 CET	38242	58638	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:27.264821053 CET	58638	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:28.147177935 CET	58640	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:28.152321100 CET	38242	58640	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:28.152422905 CET	58640	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:28.152460098 CET	58640	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:28.159181118 CET	38242	58640	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:28.659466028 CET	58640	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:28.707634926 CET	38242	58640	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:28.781660080 CET	38242	58640	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:28.781748056 CET	58640	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:29.661086082 CET	58642	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:29.666213036 CET	38242	58642	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:29.666273117 CET	58642	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:29.666273117 CET	58642	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:29.671354055 CET	38242	58642	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:30.173369884 CET	58642	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:30.219675064 CET	38242	58642	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:30.261975050 CET	38242	58642	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:30.262064934 CET	58642	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:31.175085068 CET	58644	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:31.180197954 CET	38242	58644	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:31.180249929 CET	58644	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:31.180301905 CET	58644	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:31.185605049 CET	38242	58644	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:31.686897039 CET	58644	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:31.735685110 CET	38242	58644	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:31.778630972 CET	38242	58644	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:31.778728962 CET	58644	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:32.688220024 CET	58646	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:32.693258047 CET	38242	58646	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:32.693324089 CET	58646	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:32.693324089 CET	58646	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:32.698380947 CET	38242	58646	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:33.198977947 CET	58646	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:33.251622915 CET	38242	58646	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:33.294406891 CET	38242	58646	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:33.294497967 CET	58646	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:34.202622890 CET	58648	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:34.207813978 CET	38242	58648	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:34.207906008 CET	58648	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:34.207962990 CET	58648	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:34.213001013 CET	38242	58648	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:34.379606009 CET	38242	58620	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:34.379723072 CET	58620	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:34.714591026 CET	58648	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:34.763636112 CET	38242	58648	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:34.813426018 CET	38242	58648	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:34.813652039 CET	58648	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:35.716238022 CET	58650	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:35.721385956 CET	38242	58650	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:35.721476078 CET	58650	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:35.721527100 CET	58650	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:35.726532936 CET	38242	58650	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:36.230453968 CET	58650	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:36.279633045 CET	38242	58650	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:36.333904982 CET	38242	58650	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:36.334016085 CET	58650	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:37.232088089 CET	58652	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:37.237261057 CET	38242	58652	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:37.237323046 CET	58652	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:37.237323046 CET	58652	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:37.242383003 CET	38242	58652	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:37.743237972 CET	58652	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:37.791646957 CET	38242	58652	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:37.835500002 CET	38242	58652	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:37.835634947 CET	58652	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:38.307306051 CET	38242	58630	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:38.307463884 CET	58630	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:38.744559050 CET	58654	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:38.750435114 CET	38242	58654	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:38.750499964 CET	58654	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:38.750529051 CET	58654	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:38.755953074 CET	38242	58654	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:39.256422043 CET	58654	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:39.303625107 CET	38242	58654	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:39.349117994 CET	38242	58654	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:39.349201918 CET	58654	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:40.257576942 CET	58656	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:40.262815952 CET	38242	58656	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:40.262923002 CET	58656	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:40.263086081 CET	58656	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:40.268129110 CET	38242	58656	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:40.770292044 CET	58656	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 09:26:40.819631100 CET	38242	58656	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:40.866466045 CET	38242	58656	176.65.134.15	192.168.2.23
Mar 4, 2025 09:26:40.866627932 CET	58656	38242	192.168.2.23	176.65.134.15

System Behavior

Analysis Process: dash PID: 6203, Parent PID: 4331

General

Start time (UTC):	08:24:29
Start date (UTC):	04/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 6203, Parent PID: 4331

General

Start time (UTC):	08:24:29
Start date (UTC):	04/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.reaLdyPxME /tmp/tmp.YJouaAPuE7 /tmp/tmp.InV1bB0OXq
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

File Activities

File Opened

File Deleted

File Read

Chronological Activities

Analysis Process: dash PID: 6204, Parent PID: 4331

General

Start time (UTC):	08:24:29
Start date (UTC):	04/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 6204, Parent PID: 4331

General

Start time (UTC):	08:24:29
Start date (UTC):	04/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.reaLdyPxME /tmp/tmp.YJouaAPuE7 /tmp/tmp.InV1bB0OXq
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

File Activities

File Opened

File Deleted

File Read

Chronological Activities

Analysis Process: x86_32.nn.elf PID: 6213, Parent PID: 6128

General

Start time (UTC):	08:24:35
Start date (UTC):	04/03/2025
Path:	/tmp/x86_32.nn.elf
Arguments:	/tmp/x86_32.nn.elf
File size:	91696 bytes
MD5 hash:	043823a070b59144403d9f8e41de70b3

File Activities

File Opened

File Deleted

File Read

File Written

Directory Enumerated

Symbolic Link Created

Process Activities

Process Forked

Prctl Requested

Chronological Activities

Analysis Process: x86_32.nn.elf PID: 6229, Parent PID: 6213

General

Start time (UTC):	08:24:35
Start date (UTC):	04/03/2025
Path:	/tmp/x86_32.nn.elf
Arguments:	-
File size:	91696 bytes
MD5 hash:	043823a070b59144403d9f8e41de70b3

Process Activities

Process Forked

Thread Sleep

Chronological Activities

Analysis Process: x86_32.nn.elf PID: 6232, Parent PID: 6229

General

Start time (UTC):	08:24:35
Start date (UTC):	04/03/2025
Path:	/tmp/x86_32.nn.elf
Arguments:	-
File size:	91696 bytes
MD5 hash:	043823a070b59144403d9f8e41de70b3

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Prctl Requested

Thread Sleep

Chronological Activities

Analysis Process: udisksd PID: 6222, Parent PID: 799

General

Start time (UTC):	08:24:35
Start date (UTC):	04/03/2025
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: dumpe2fs PID: 6222, Parent PID: 799

General

Start time (UTC):	08:24:35
Start date (UTC):	04/03/2025
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

File Activities

File Opened

File Read

Process Activities

Prctl Requested

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: udisksd PID: 6260, Parent PID: 799

General

Start time (UTC):	08:24:35
Start date (UTC):	04/03/2025
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: dumpe2fs PID: 6260, Parent PID: 799

General

Start time (UTC):	08:24:35
Start date (UTC):	04/03/2025
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report x86_32.nn.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/etc/motd

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: dash PID: 6203, Parent PID: 4331

General

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 6203, Parent PID: 4331

General

File Activities

File Opened

File Deleted

File Read

Chronological Activities

Analysis Process: dash PID: 6204, Parent PID: 4331

General

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 6204, Parent PID: 4331

General

File Activities

File Opened

File Deleted

Linux Analysis Report
x86_32.nn.elf