Edit tour

Linux Analysis Report
mipsel.nn.elf

Overview

General Information

Sample name:	mipsel.nn.elf
Analysis ID:	1628924
MD5:	581ba992c7f761aae27008e9ac07a510
SHA1:	1190e6093cfbca659a0eaf3c439f510ee53ae8fd
SHA256:	03713be5042298c7483bcf6edd3c3330356af2fd69b9195cbc90a7b8a7ec3de7
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	64
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Mirai

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample has stripped symbol table

Sample listens on a socket

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1628924
Start date and time:	2025-03-04 09:28:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	mipsel.nn.elf
Detection:	MAL
Classification:	mal64.troj.linELF@0/2@0/0

Runtime Messages

Command:	/tmp/mipsel.nn.elf
PID:	5439
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	The Gorilla Botnet Cats Came After You!
Standard Error:

Process Tree

system is lnxubuntu20

mipsel.nn.elf (PID: 5439, Parent: 5352, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/mipsel.nn.elf

mipsel.nn.elf New Fork (PID: 5462, Parent: 5439)

mipsel.nn.elf New Fork (PID: 5464, Parent: 5462)

udisksd New Fork (PID: 5449, Parent: 802)

dumpe2fs (PID: 5449, Parent: 802, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

udisksd New Fork (PID: 5474, Parent: 802)

dumpe2fs (PID: 5474, Parent: 802, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
mipsel.nn.elf	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
5439.1.00007f4ec0400000.00007f4ec0420000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Persistence and Installation Behavior
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: mipsel.nn.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: mipsel.nn.elf	Virustotal: Detection: 32%			Perma Link
Source: mipsel.nn.elf	ReversingLabs: Detection: 42%

Source: global traffic

TCP traffic: 192.168.2.13:56876 -> 176.65.134.15:38242

Source: /tmp/mipsel.nn.elf (PID: 5439)

Socket: 127.0.0.1:38242

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal64.troj.linELF@0/2@0/0

Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5482/status	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5540/status	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5541/status	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5542/status	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5488/status	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5543/status	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5533/status	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5534/status	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5535/status	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5536/status	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5537/status	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5538/status	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5539/status	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5474/status	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5530/status	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5531/status	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5532/status	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5269/cmdline	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5467/status	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5544/status	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5503/status	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5527/status	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5528/status	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5464)	File opened: /proc/5529/status	Jump to behavior

Source: /tmp/mipsel.nn.elf (PID: 5439)

Queries kernel information via 'uname':

Jump to behavior

Source: mipsel.nn.elf, 5439.1.00005652db552000.00005652db5f9000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: mipsel.nn.elf, 5439.1.00005652db552000.00005652db5f9000.rw-.sdmp	Binary or memory string: RV0!/usr/bin/vmtoolsd
Source: mipsel.nn.elf, 5439.1.00007ffd538f6000.00007ffd53917000.rw-.sdmp	Binary or memory string: /qemu-open.XXXXX
Source: mipsel.nn.elf, 5439.1.00005652db552000.00005652db5f9000.rw-.sdmp	Binary or memory string: /usr/bin/vmtoolsd
Source: mipsel.nn.elf, 5439.1.00005652db552000.00005652db5f9000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmtP
Source: mipsel.nn.elf, 5439.1.00007ffd538f6000.00007ffd53917000.rw-.sdmp	Binary or memory string: RV/tmp/qemu-open.D4d0cv\
Source: mipsel.nn.elf, 5439.1.00007ffd538f6000.00007ffd53917000.rw-.sdmp	Binary or memory string: 9qx86_64/usr/bin/qemu-mipsel/tmp/mipsel.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mipsel.nn.elf
Source: mipsel.nn.elf, 5439.1.00005652db552000.00005652db5f9000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmtP /usr/bin/dmesgddressboo
Source: mipsel.nn.elf, 5439.1.00005652db552000.00005652db5f9000.rw-.sdmp	Binary or memory string: RV!/etc/qemu-binfmt/mipsel
Source: mipsel.nn.elf, 5439.1.00007ffd538f6000.00007ffd53917000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel
Source: mipsel.nn.elf, 5439.1.00007ffd538f6000.00007ffd53917000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.D4d0cv

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: mipsel.nn.elf, type: SAMPLE
Source: Yara match	File source: 5439.1.00007f4ec0400000.00007f4ec0420000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: mipsel.nn.elf, type: SAMPLE
Source: Yara match	File source: 5439.1.00007f4ec0400000.00007f4ec0420000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
mipsel.nn.elf	32%	Virustotal		Browse
mipsel.nn.elf	42%	ReversingLabs	Linux.Backdoor.Mirai
mipsel.nn.elf	100%	Avira	EXP/ELF.Mirai.W

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
176.65.134.15	unknown	Germany		56325	DIOGELO-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
176.65.134.15	x86_32.nn.elf	Get hash	malicious	Mirai	Browse
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse
	sparc.nn.elf	Get hash	malicious	Mirai	Browse
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse
	powerpc.nn.elf	Get hash	malicious	Mirai	Browse
	mipsel.nn.elf	Get hash	malicious	Mirai	Browse
	x86_32.nn.elf	Get hash	malicious	Mirai	Browse
	mipsel.nn.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	x86_32.nn.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	powerpc.nn.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIOGELO-ASGB	x86_32.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	sparc.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	powerpc.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	mipsel.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	x86_32.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	mipsel.nn.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	176.65.134.15
	x86_32.nn.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	176.65.134.15
	powerpc.nn.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	176.65.134.15

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/etc/motd

Download File

Process:	/tmp/mipsel.nn.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	53
Entropy (8bit):	3.871459242626451
Encrypted:	false
SSDEEP:	3:yGKtARxFQFrgBJ4BJ+3e:dQ0EcHG2e
MD5:	2BD9B4BE30579E633FC0191AA93DF486
SHA1:	7D63A9BD9662E86666B27C1B50DB8E7370C624FF
SHA-256:	64DC39F3004DC93C9FC4F1467B4807F2D8E3EB0BFA96B15C19CD8E7D6FA77A1D
SHA-512:	AE6DD7B39191354CF43CF65E517460D7D4C61B8F5C08E33E6CA3C451DC7CAB4DE89F33934C89396B80F1AADE0A4E2571BD5AE8B76EF80B737D4588703D2814D5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	gorilla botnet is on the device ur not a cat go away.

/tmp/qemu-open.D4d0cv (deleted)

Download File

Process:	/tmp/mipsel.nn.elf
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.5110854081804286
Encrypted:	false
SSDEEP:	3:Tgaw/iln:Tgl/Gn
MD5:	E161F2EC9C1A693BE77DD848C5A17087
SHA1:	C6DC3683D6AF6B3AD69F1E155638994278FD3DC9
SHA-256:	6EC0A33B73DE74EBEB61B23D54BFF44B920A3F994E0781781253974DB671921F
SHA-512:	79FEC2E25B4E40804C09089CDAC6D8A9C2FE0F90D096D6DEF3DE458D572EBE6D18740670BA9F33B45DAA80D4104252ECAAB075B44D5ED9BEDF8C5644DB302145
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	/tmp/mipsel.nn.elf.

Static File Info

General

File type:	ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.6083879046035845
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	mipsel.nn.elf
File size:	133'596 bytes
MD5:	581ba992c7f761aae27008e9ac07a510
SHA1:	1190e6093cfbca659a0eaf3c439f510ee53ae8fd
SHA256:	03713be5042298c7483bcf6edd3c3330356af2fd69b9195cbc90a7b8a7ec3de7
SHA512:	9ccda69e588486fa60a2cb2c0c58eb89fdd084d705b0adff62056d22ae99fbe5fac00555924143a37ae13c0408ca700f1b57176afc6f4bf80fe2b8c03e6166f2
SSDEEP:	1536:zwQ57jrCP8AO1osqhdgSqmDfRdHe7GjUC3q+ZG8d12utPo3ZBBat6+n:0873a8uS7GwC7zNAO6+n
TLSH:	59D30805BF610FFBE8AFCD3342BD070625CD584722A96B763A34D918F54B14B1AE3968
File Content Preview:	.ELF....................`.@.4...........4. ...(...............@...@...........................E...E.t....s..........Q.td...............................<...'!......'.......................<.~.'!... .........9'.. ........................<.~.'!...........p.9

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	133036
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x1dac0	0x0	0x6	AX	16
.fini	PROGBITS	0x41dbe0	0x1dbe0	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x41dc40	0x1dc40	0x1d90	0x0	0x2	A	16
.ctors	PROGBITS	0x45f9d4	0x1f9d4	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x45f9dc	0x1f9dc	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x45f9e8	0x1f9e8	0x54	0x0	0x3	WA	4
.data	PROGBITS	0x45fa40	0x1fa40	0x568	0x0	0x3	WA	16
.got	PROGBITS	0x45ffb0	0x1ffb0	0x798	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x460748	0x20748	0x28	0x0	0x10000003	WAp	4
.bss	NOBITS	0x460770	0x20748	0x6578	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0xea0	0x20748	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x20748	0x64	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x1f9d0	0x1f9d0	5.6217	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x1f9d4	0x45f9d4	0x45f9d4	0xd74	0x7314	4.2908	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Download Network PCAP: filtered – full

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 4, 2025 09:29:30.923304081 CET	56876	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:31.061386108 CET	38242	56876	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:31.061482906 CET	56876	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:31.063572884 CET	56876	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:31.068645954 CET	38242	56876	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:31.577197075 CET	56876	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:31.626530886 CET	38242	56876	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:32.579926968 CET	56878	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:32.585103035 CET	38242	56878	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:32.585205078 CET	56878	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:32.585205078 CET	56878	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:32.590275049 CET	38242	56878	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:33.097450018 CET	56878	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:33.146471977 CET	38242	56878	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:34.099344969 CET	56880	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:34.104501009 CET	38242	56880	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:34.104557991 CET	56880	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:34.104592085 CET	56880	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:34.109666109 CET	38242	56880	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:34.610636950 CET	56880	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:34.659744024 CET	38242	56880	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:34.689660072 CET	38242	56876	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:34.689974070 CET	56876	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:35.612102985 CET	56882	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:35.617175102 CET	38242	56882	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:35.617264986 CET	56882	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:35.617279053 CET	56882	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:35.622345924 CET	38242	56882	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:36.122940063 CET	56882	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:36.170473099 CET	38242	56882	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:36.206283092 CET	38242	56878	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:36.206407070 CET	56878	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:36.215332985 CET	38242	56882	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:36.215430021 CET	56882	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:37.125667095 CET	56884	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:37.130743027 CET	38242	56884	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:37.130816936 CET	56884	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:37.130902052 CET	56884	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:37.135967970 CET	38242	56884	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:37.650202990 CET	56884	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:37.702389002 CET	38242	56884	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:37.731374025 CET	38242	56884	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:37.731441021 CET	56884	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:38.651851892 CET	56886	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:38.657202959 CET	38242	56886	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:38.657289982 CET	56886	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:38.657325029 CET	56886	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:38.662323952 CET	38242	56886	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:39.162770987 CET	56886	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:39.284928083 CET	38242	56886	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:39.285021067 CET	56886	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:40.164721966 CET	56888	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:40.170774937 CET	38242	56888	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:40.170881987 CET	56888	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:40.170901060 CET	56888	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:40.178112984 CET	38242	56888	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:40.677383900 CET	56888	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:40.726408005 CET	38242	56888	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:41.679152966 CET	56890	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:41.684273005 CET	38242	56890	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:41.684344053 CET	56890	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:41.684366941 CET	56890	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:41.689397097 CET	38242	56890	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:42.190059900 CET	56890	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:42.242402077 CET	38242	56890	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:43.191241026 CET	56892	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:43.196358919 CET	38242	56892	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:43.196449995 CET	56892	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:43.196477890 CET	56892	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:43.201512098 CET	38242	56892	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:43.701229095 CET	56892	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:43.746402979 CET	38242	56892	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:43.790472984 CET	38242	56892	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:43.790546894 CET	56892	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:44.702640057 CET	56894	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:44.707813025 CET	38242	56894	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:44.707926035 CET	56894	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:44.707972050 CET	56894	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:44.713004112 CET	38242	56894	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:45.214884043 CET	56894	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:45.266396999 CET	38242	56894	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:45.313273907 CET	38242	56894	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:45.313386917 CET	56894	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:46.216895103 CET	56896	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:46.222318888 CET	38242	56896	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:46.222419977 CET	56896	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:46.222419977 CET	56896	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:46.229032993 CET	38242	56896	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:46.729988098 CET	56896	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:46.778332949 CET	38242	56896	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:46.852895975 CET	38242	56896	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:46.853015900 CET	56896	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:47.731343985 CET	56898	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:47.741142988 CET	38242	56898	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:47.741278887 CET	56898	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:47.741337061 CET	56898	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:47.746712923 CET	38242	56880	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:47.746793985 CET	56880	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:47.751004934 CET	38242	56898	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:48.246984005 CET	56898	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:48.298361063 CET	38242	56898	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:48.343534946 CET	38242	56898	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:48.343610048 CET	56898	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:49.248197079 CET	56900	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:49.255408049 CET	38242	56900	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:49.255495071 CET	56900	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:49.255523920 CET	56900	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:49.263251066 CET	38242	56900	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:49.760726929 CET	56900	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:49.777457952 CET	38242	56888	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:49.777548075 CET	56888	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:49.806550026 CET	38242	56900	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:49.859101057 CET	38242	56900	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:49.859227896 CET	56900	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:50.761873007 CET	56902	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:50.767045021 CET	38242	56902	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:50.767127991 CET	56902	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:50.767151117 CET	56902	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:50.772129059 CET	38242	56902	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:51.273381948 CET	56902	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:51.294677019 CET	38242	56890	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:51.294780970 CET	56890	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:51.323019028 CET	38242	56902	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:51.362711906 CET	38242	56902	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:51.362790108 CET	56902	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:52.274602890 CET	56904	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:52.414725065 CET	38242	56904	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:52.414815903 CET	56904	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:52.414815903 CET	56904	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:52.421339989 CET	38242	56904	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:52.918732882 CET	56904	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:52.966367960 CET	38242	56904	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:53.031274080 CET	38242	56904	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:53.031368971 CET	56904	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:53.919735909 CET	56906	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:53.925000906 CET	38242	56906	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:53.925108910 CET	56906	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:53.925172091 CET	56906	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:53.930212975 CET	38242	56906	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:54.428827047 CET	56906	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:54.478327036 CET	38242	56906	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:54.546318054 CET	38242	56906	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:54.546431065 CET	56906	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:55.429951906 CET	56908	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:55.435195923 CET	38242	56908	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:55.435302973 CET	56908	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:55.435302973 CET	56908	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:55.440640926 CET	38242	56908	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:55.940439939 CET	56908	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:55.986340046 CET	38242	56908	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:56.941622019 CET	56910	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:56.948565960 CET	38242	56910	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:56.948688030 CET	56910	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:56.948724031 CET	56910	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:56.955760956 CET	38242	56910	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:57.452269077 CET	56910	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:57.498282909 CET	38242	56910	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:57.563405037 CET	38242	56910	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:57.563478947 CET	56910	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:58.453448057 CET	56912	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:58.459567070 CET	38242	56912	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:58.459690094 CET	56912	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:58.459711075 CET	56912	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:58.466176033 CET	38242	56912	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:58.963562012 CET	56912	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:59.014373064 CET	38242	56912	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:59.081044912 CET	38242	56912	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:59.081131935 CET	56912	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:59.964716911 CET	56914	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:59.969830990 CET	38242	56914	176.65.134.15	192.168.2.13
Mar 4, 2025 09:29:59.969913006 CET	56914	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:59.969929934 CET	56914	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:29:59.974963903 CET	38242	56914	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:00.474487066 CET	56914	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:00.522378922 CET	38242	56914	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:00.571775913 CET	38242	56914	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:00.571841955 CET	56914	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:01.476125002 CET	56916	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:01.481293917 CET	38242	56916	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:01.481395960 CET	56916	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:01.481437922 CET	56916	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:01.486449957 CET	38242	56916	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:01.985235929 CET	56916	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:02.034280062 CET	38242	56916	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:02.102509022 CET	38242	56916	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:02.102590084 CET	56916	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:02.986398935 CET	56918	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:02.991450071 CET	38242	56918	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:02.991519928 CET	56918	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:02.991549969 CET	56918	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:02.996516943 CET	38242	56918	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:03.495553017 CET	56918	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:03.542274952 CET	38242	56918	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:03.589153051 CET	38242	56918	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:03.589225054 CET	56918	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:04.496675968 CET	56920	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:04.501804113 CET	38242	56920	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:04.501880884 CET	56920	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:04.501916885 CET	56920	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:04.507623911 CET	38242	56920	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:05.005667925 CET	56920	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:05.054246902 CET	38242	56920	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:05.119121075 CET	38242	56920	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:05.119206905 CET	56920	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:06.006752014 CET	56922	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:06.012037039 CET	38242	56922	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:06.012196064 CET	56922	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:06.012196064 CET	56922	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:06.017263889 CET	38242	56922	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:06.516391993 CET	56922	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:06.614233017 CET	38242	56922	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:06.622008085 CET	38242	56922	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:06.622073889 CET	56922	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:07.517435074 CET	56924	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:07.522515059 CET	38242	56924	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:07.522572041 CET	56924	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:07.522599936 CET	56924	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:07.527606010 CET	38242	56924	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:08.026418924 CET	56924	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:08.078231096 CET	38242	56924	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:09.027762890 CET	56926	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:09.034310102 CET	38242	56926	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:09.034394026 CET	56926	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:09.034409046 CET	56926	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:09.039410114 CET	38242	56926	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:09.538182020 CET	56926	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:09.586313009 CET	38242	56926	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:10.539248943 CET	56928	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:10.544383049 CET	38242	56928	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:10.544508934 CET	56928	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:10.544529915 CET	56928	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:10.549566984 CET	38242	56928	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:11.048794031 CET	56928	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:11.094223976 CET	38242	56928	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:11.156790018 CET	38242	56928	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:11.156889915 CET	56928	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:12.049750090 CET	56930	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:12.676789999 CET	38242	56930	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:12.676858902 CET	56930	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:12.676896095 CET	56930	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:12.681911945 CET	38242	56930	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:13.181135893 CET	56930	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:13.226279020 CET	38242	56930	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:13.279923916 CET	38242	56930	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:13.280025005 CET	56930	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:14.182173014 CET	56932	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:14.187246084 CET	38242	56932	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:14.187352896 CET	56932	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:14.187367916 CET	56932	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:14.193371058 CET	38242	56932	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:14.691689014 CET	56932	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:14.738260984 CET	38242	56932	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:14.791062117 CET	38242	56932	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:14.791193962 CET	56932	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:15.692866087 CET	56934	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:15.697916031 CET	38242	56934	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:15.697978020 CET	56934	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:15.698013067 CET	56934	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:15.703033924 CET	38242	56934	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:16.201781988 CET	56934	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:16.250205040 CET	38242	56934	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:16.331669092 CET	38242	56934	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:16.331762075 CET	56934	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:17.202841997 CET	56936	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:17.778018951 CET	38242	56908	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:17.778116941 CET	56908	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:17.784513950 CET	38242	56908	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:17.784580946 CET	56908	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:17.785330057 CET	38242	56908	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:17.785379887 CET	56908	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:17.785868883 CET	38242	56908	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:17.785924911 CET	56908	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:17.786233902 CET	38242	56936	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:17.786304951 CET	56936	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:17.786349058 CET	56936	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:17.794117928 CET	38242	56908	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:17.794512987 CET	38242	56908	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:17.794698000 CET	38242	56908	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:17.794935942 CET	38242	56936	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:18.289980888 CET	56936	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:18.338236094 CET	38242	56936	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:18.387218952 CET	38242	56936	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:18.387340069 CET	56936	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:19.290983915 CET	56938	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:19.296962023 CET	38242	56938	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:19.297107935 CET	56938	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:19.297128916 CET	56938	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:19.302328110 CET	38242	56938	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:19.801215887 CET	56938	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:19.850423098 CET	38242	56938	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:19.924668074 CET	38242	56938	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:19.924762964 CET	56938	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:20.802174091 CET	56940	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:20.807214022 CET	38242	56940	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:20.807300091 CET	56940	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:20.807300091 CET	56940	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:20.812473059 CET	38242	56940	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:21.310612917 CET	56940	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:21.358246088 CET	38242	56940	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:21.415352106 CET	38242	56940	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:21.415456057 CET	56940	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:22.311528921 CET	56942	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:22.316641092 CET	38242	56942	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:22.316834927 CET	56942	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:22.316850901 CET	56942	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:22.321870089 CET	38242	56942	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:22.820796967 CET	56942	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:22.870600939 CET	38242	56942	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:23.822248936 CET	56944	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:23.829273939 CET	38242	56944	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:23.829418898 CET	56944	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:23.829420090 CET	56944	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:23.836473942 CET	38242	56944	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:24.332809925 CET	56944	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:24.378220081 CET	38242	56944	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:24.452111959 CET	38242	56944	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:24.452209949 CET	56944	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:25.333723068 CET	56946	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:25.338762999 CET	38242	56946	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:25.338838100 CET	56946	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:25.338838100 CET	56946	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:25.343898058 CET	38242	56946	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:25.842713118 CET	56946	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:25.894176960 CET	38242	56946	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:25.933340073 CET	38242	56946	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:25.933471918 CET	56946	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:26.843874931 CET	56948	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:26.848951101 CET	38242	56948	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:26.849069118 CET	56948	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:26.849069118 CET	56948	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:26.854137897 CET	38242	56948	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:27.353171110 CET	56948	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:27.402158022 CET	38242	56948	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:27.445115089 CET	38242	56948	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:27.445203066 CET	56948	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:28.354631901 CET	56950	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:28.359709978 CET	38242	56950	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:28.359791040 CET	56950	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:28.359791040 CET	56950	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:28.365020037 CET	38242	56950	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:28.864931107 CET	56950	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:28.898462057 CET	38242	56924	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:28.898569107 CET	56924	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:28.914141893 CET	38242	56950	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:28.961498022 CET	38242	56950	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:28.961596966 CET	56950	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:29.866264105 CET	56952	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:29.872133017 CET	38242	56952	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:29.872340918 CET	56952	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:29.872342110 CET	56952	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:29.877424955 CET	38242	56952	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:30.376898050 CET	56952	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:30.412184000 CET	38242	56926	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:30.412302971 CET	56926	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:30.422096014 CET	38242	56952	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:31.378390074 CET	56954	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:31.383375883 CET	38242	56954	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:31.383536100 CET	56954	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:31.383594990 CET	56954	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:31.388622999 CET	38242	56954	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:31.888326883 CET	56954	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:31.933928967 CET	38242	56942	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:31.934021950 CET	56942	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:31.938116074 CET	38242	56954	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:31.982825041 CET	38242	56954	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:31.982960939 CET	56954	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:32.890091896 CET	56956	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:32.895214081 CET	38242	56956	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:32.895287991 CET	56956	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:32.895371914 CET	56956	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:32.900414944 CET	38242	56956	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:33.401096106 CET	56956	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:33.450081110 CET	38242	56956	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:33.515837908 CET	38242	56956	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:33.515934944 CET	56956	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:34.402760983 CET	56958	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:34.407764912 CET	38242	56958	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:34.407902002 CET	56958	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:34.407936096 CET	56958	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:34.412990093 CET	38242	56958	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:34.914391041 CET	56958	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:34.962126970 CET	38242	56958	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:35.916310072 CET	56960	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:35.921377897 CET	38242	56960	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:35.921456099 CET	56960	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:35.921523094 CET	56960	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:35.926559925 CET	38242	56960	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:36.427412033 CET	56960	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:36.478065014 CET	38242	56960	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:36.543231964 CET	38242	56960	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:36.543365955 CET	56960	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:37.428814888 CET	56962	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:37.435465097 CET	38242	56962	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:37.435600042 CET	56962	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:37.435626030 CET	56962	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:37.440742970 CET	38242	56962	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:37.940387964 CET	56962	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:37.986120939 CET	38242	56962	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:38.033334970 CET	38242	56962	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:38.033627987 CET	56962	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:38.941888094 CET	56964	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:38.949287891 CET	38242	56964	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:38.949383974 CET	56964	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:38.949383974 CET	56964	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:38.956324100 CET	38242	56964	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:39.454863071 CET	56964	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:39.502126932 CET	38242	56964	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:39.544852972 CET	38242	56952	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:39.544997931 CET	56952	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:39.698975086 CET	38242	56964	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:39.699120045 CET	56964	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:40.457119942 CET	56966	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:40.462189913 CET	38242	56966	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:40.462322950 CET	56966	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:40.462379932 CET	56966	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:40.467356920 CET	38242	56966	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:40.969738960 CET	56966	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:41.018232107 CET	38242	56966	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:41.067712069 CET	38242	56966	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:41.067816019 CET	56966	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:41.971946955 CET	56968	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:41.979017973 CET	38242	56968	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:41.979121923 CET	56968	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:41.979250908 CET	56968	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:41.984288931 CET	38242	56968	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:42.485002041 CET	56968	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:42.538099051 CET	38242	56968	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:42.573739052 CET	38242	56968	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:42.573865891 CET	56968	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:43.486757994 CET	56970	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:43.491852045 CET	38242	56970	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:43.491914034 CET	56970	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:43.491942883 CET	56970	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:43.497216940 CET	38242	56970	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:43.996555090 CET	56970	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:44.040764093 CET	38242	56958	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:44.040879965 CET	56958	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:44.046097994 CET	38242	56970	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:44.997858047 CET	56972	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:45.003026962 CET	38242	56972	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:45.003102064 CET	56972	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:45.003134012 CET	56972	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:45.008138895 CET	38242	56972	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:45.508972883 CET	56972	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:45.558563948 CET	38242	56972	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:45.597645044 CET	38242	56972	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:45.597790003 CET	56972	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:46.510693073 CET	56974	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:46.517817020 CET	38242	56974	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:46.517926931 CET	56974	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:46.517976046 CET	56974	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:46.525274038 CET	38242	56974	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:47.023746014 CET	56974	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:47.074054003 CET	38242	56974	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:47.122034073 CET	38242	56974	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:47.122131109 CET	56974	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:48.025290966 CET	56976	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:48.030390978 CET	38242	56976	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:48.030452013 CET	56976	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:48.030479908 CET	56976	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:48.035470009 CET	38242	56976	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:48.536386013 CET	56976	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:48.582077026 CET	38242	56976	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:48.637310028 CET	38242	56976	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:48.637409925 CET	56976	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:49.538533926 CET	56978	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:49.546158075 CET	38242	56978	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:49.546276093 CET	56978	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:49.546324968 CET	56978	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:49.554078102 CET	38242	56978	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:50.053014994 CET	56978	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:50.102197886 CET	38242	56978	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:51.054881096 CET	56980	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:51.060028076 CET	38242	56980	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:51.060117006 CET	56980	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:51.060132027 CET	56980	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:51.065192938 CET	38242	56980	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:51.568764925 CET	56980	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:51.614092112 CET	38242	56980	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:51.658584118 CET	38242	56980	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:51.658701897 CET	56980	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:52.570010900 CET	56982	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:52.575077057 CET	38242	56982	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:52.575198889 CET	56982	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:52.575217962 CET	56982	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:52.581962109 CET	38242	56982	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:53.080974102 CET	56982	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:53.129991055 CET	38242	56982	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:53.133399010 CET	38242	56970	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:53.133498907 CET	56970	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:54.082729101 CET	56984	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:54.087774038 CET	38242	56984	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:54.087887049 CET	56984	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:54.087956905 CET	56984	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:54.092969894 CET	38242	56984	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:54.593384027 CET	56984	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:54.642033100 CET	38242	56984	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:54.682984114 CET	38242	56984	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:54.683141947 CET	56984	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:55.594867945 CET	56986	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:55.599994898 CET	38242	56986	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:55.600121975 CET	56986	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:55.600121975 CET	56986	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:55.605245113 CET	38242	56986	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:56.105904102 CET	56986	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:56.157994986 CET	38242	56986	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:57.107403994 CET	56988	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:57.112446070 CET	38242	56988	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:57.112529039 CET	56988	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:57.112545013 CET	56988	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:57.117553949 CET	38242	56988	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:57.618310928 CET	56988	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:57.666007996 CET	38242	56988	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:57.719415903 CET	38242	56988	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:57.719567060 CET	56988	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:58.620605946 CET	56990	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:58.625740051 CET	38242	56990	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:58.625812054 CET	56990	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:58.625863075 CET	56990	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:58.630870104 CET	38242	56990	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:59.134232998 CET	56990	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:30:59.338277102 CET	38242	56990	176.65.134.15	192.168.2.13
Mar 4, 2025 09:30:59.338463068 CET	56990	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:00.136126995 CET	56992	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:00.141176939 CET	38242	56992	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:00.141236067 CET	56992	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:00.141258955 CET	56992	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:00.146373987 CET	38242	56992	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:00.647730112 CET	56992	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:00.694009066 CET	38242	56992	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:00.906596899 CET	38242	56992	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:00.906748056 CET	56992	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:01.649276972 CET	56994	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:01.654349089 CET	38242	56994	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:01.654445887 CET	56994	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:01.654509068 CET	56994	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:01.659590960 CET	38242	56994	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:02.159898043 CET	56994	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:02.183875084 CET	38242	56982	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:02.184078932 CET	56982	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:02.206056118 CET	38242	56994	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:02.268563032 CET	38242	56994	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:02.268667936 CET	56994	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:03.161696911 CET	56996	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:03.166814089 CET	38242	56996	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:03.166897058 CET	56996	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:03.166977882 CET	56996	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:03.171972036 CET	38242	56996	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:03.671895027 CET	56996	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:03.718064070 CET	38242	56996	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:03.851795912 CET	38242	56996	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:03.851905107 CET	56996	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:04.673113108 CET	56998	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:04.751451015 CET	38242	56998	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:04.751560926 CET	56998	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:04.751596928 CET	56998	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:04.756676912 CET	38242	56998	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:05.204035997 CET	38242	56986	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:05.204186916 CET	56986	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:05.255635023 CET	56998	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:05.302488089 CET	38242	56998	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:05.368432999 CET	38242	56998	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:05.368546963 CET	56998	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:06.257313013 CET	57000	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:06.262537956 CET	38242	57000	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:06.262650967 CET	57000	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:06.262689114 CET	57000	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:06.267719984 CET	38242	57000	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:06.767472029 CET	57000	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:06.817925930 CET	38242	57000	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:06.860984087 CET	38242	57000	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:06.861063957 CET	57000	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:07.769134045 CET	57002	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:07.774656057 CET	38242	57002	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:07.774755001 CET	57002	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:07.774817944 CET	57002	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:07.780504942 CET	38242	57002	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:08.280659914 CET	57002	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:08.325989962 CET	38242	57002	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:08.422238111 CET	38242	57002	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:08.422353983 CET	57002	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:09.282764912 CET	57004	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:09.288857937 CET	38242	57004	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:09.288973093 CET	57004	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:09.289094925 CET	57004	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:09.295038939 CET	38242	57004	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:09.795238972 CET	57004	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:09.842017889 CET	38242	57004	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:09.927544117 CET	38242	57004	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:09.927630901 CET	57004	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:10.797228098 CET	57006	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:10.802267075 CET	38242	57006	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:10.802331924 CET	57006	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:10.802367926 CET	57006	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:10.807356119 CET	38242	57006	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:10.914156914 CET	38242	56978	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:10.914299965 CET	56978	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:11.309529066 CET	57006	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:11.357888937 CET	38242	57006	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:11.419080019 CET	38242	57006	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:11.419178009 CET	57006	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:12.311252117 CET	57008	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:12.316407919 CET	38242	57008	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:12.316498995 CET	57008	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:12.316590071 CET	57008	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:12.321559906 CET	38242	57008	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:12.823649883 CET	57008	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:12.869930983 CET	38242	57008	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:13.825814009 CET	57010	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:13.831613064 CET	38242	57010	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:13.831773043 CET	57010	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:13.831773043 CET	57010	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:13.836771011 CET	38242	57010	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:14.337994099 CET	57010	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:14.438764095 CET	38242	57010	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:14.438930035 CET	57010	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:15.339924097 CET	57012	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:15.344996929 CET	38242	57012	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:15.345071077 CET	57012	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:15.345093012 CET	57012	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:15.350178003 CET	38242	57012	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:15.852577925 CET	57012	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:15.898130894 CET	38242	57012	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:15.957480907 CET	38242	57012	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:15.957573891 CET	57012	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:16.854908943 CET	57014	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:16.859937906 CET	38242	57014	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:16.860066891 CET	57014	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:16.860152960 CET	57014	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:16.865098000 CET	38242	57014	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:17.368582010 CET	57014	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:17.413902998 CET	38242	57014	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:17.459990978 CET	38242	57014	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:17.460087061 CET	57014	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:18.370481014 CET	57016	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:18.375931978 CET	38242	57016	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:18.376061916 CET	57016	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:18.376146078 CET	57016	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:18.381144047 CET	38242	57016	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:18.884335995 CET	57016	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:18.929874897 CET	38242	57016	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:19.886878967 CET	57018	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:19.891962051 CET	38242	57018	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:19.892015934 CET	57018	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:19.892040014 CET	57018	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:19.897092104 CET	38242	57018	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:20.005129099 CET	38242	57016	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:20.005261898 CET	57016	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:20.399866104 CET	57018	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:20.445993900 CET	38242	57018	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:20.513880014 CET	38242	57018	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:20.514017105 CET	57018	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:21.401987076 CET	57020	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:21.407078981 CET	38242	57020	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:21.407205105 CET	57020	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:21.407205105 CET	57020	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:21.412524939 CET	38242	57020	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:21.912393093 CET	57020	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:21.962390900 CET	38242	57020	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:22.022636890 CET	38242	57020	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:22.022768974 CET	57020	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:22.914009094 CET	57022	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:22.919091940 CET	38242	57022	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:22.919142962 CET	57022	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:22.919161081 CET	57022	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:22.924177885 CET	38242	57022	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:23.427310944 CET	57022	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:23.474260092 CET	38242	57022	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:23.523996115 CET	38242	57022	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:23.524127007 CET	57022	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:24.429776907 CET	57024	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:24.434907913 CET	38242	57024	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:24.434990883 CET	57024	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:24.435060978 CET	57024	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:24.440100908 CET	38242	57024	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:24.942493916 CET	57024	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:24.989907980 CET	38242	57024	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:25.944591999 CET	57026	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:25.949722052 CET	38242	57026	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:25.949816942 CET	57026	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:25.949898958 CET	57026	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:25.954886913 CET	38242	57026	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:26.456439972 CET	57026	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:26.501921892 CET	38242	57026	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:26.553319931 CET	38242	57026	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:26.553472042 CET	57026	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:27.458252907 CET	57028	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:27.463800907 CET	38242	57028	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:27.463875055 CET	57028	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:27.463949919 CET	57028	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:27.469369888 CET	38242	57028	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:27.971225023 CET	57028	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:28.017949104 CET	38242	57028	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:28.098196030 CET	38242	57028	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:28.098337889 CET	57028	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:28.973294973 CET	57030	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:28.978394985 CET	38242	57030	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:28.978480101 CET	57030	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:28.978533030 CET	57030	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:28.983530045 CET	38242	57030	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:29.484154940 CET	57030	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:29.529922009 CET	38242	57030	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:29.599726915 CET	38242	57030	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:29.599878073 CET	57030	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:30.485600948 CET	57032	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:30.492688894 CET	38242	57032	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:30.492826939 CET	57032	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:30.492911100 CET	57032	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:30.499214888 CET	38242	57032	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:30.998677015 CET	57032	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:31.045928001 CET	38242	57032	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:32.000183105 CET	57034	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:32.005317926 CET	38242	57034	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:32.005393982 CET	57034	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:32.005419970 CET	57034	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:32.010457993 CET	38242	57034	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:32.511871099 CET	57034	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:32.557881117 CET	38242	57034	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:32.624470949 CET	38242	57034	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:32.624597073 CET	57034	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:33.513578892 CET	57036	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:33.696094990 CET	38242	57008	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:33.696254969 CET	57008	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:33.696417093 CET	38242	57036	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:33.696521997 CET	57036	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:33.696629047 CET	57036	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:33.701659918 CET	38242	57036	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:34.067104101 CET	38242	57024	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:34.067270041 CET	57024	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:34.202857971 CET	57036	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:34.253871918 CET	38242	57036	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:35.204755068 CET	57038	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:35.209815025 CET	38242	57038	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:35.209897995 CET	57038	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:35.209923983 CET	57038	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:35.214920998 CET	38242	57038	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:35.716418982 CET	57038	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:35.901983023 CET	38242	57038	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:36.717947006 CET	57040	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:36.723325968 CET	38242	57040	176.65.134.15	192.168.2.13
Mar 4, 2025 09:31:36.723382950 CET	57040	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:36.723411083 CET	57040	38242	192.168.2.13	176.65.134.15
Mar 4, 2025 09:31:36.728418112 CET	38242	57040	176.65.134.15	192.168.2.13

System Behavior

Analysis Process: mipsel.nn.elf PID: 5439, Parent PID: 5352

General

Start time (UTC):	08:29:30
Start date (UTC):	04/03/2025
Path:	/tmp/mipsel.nn.elf
Arguments:	/tmp/mipsel.nn.elf
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

File Activities

File Opened

File Deleted

File Read

File Written

Directory Enumerated

Symbolic Link Created

Process Activities

Process Forked

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Listening

Socket Connecting

Chronological Activities

Analysis Process: mipsel.nn.elf PID: 5462, Parent PID: 5439

General

Start time (UTC):	08:29:30
Start date (UTC):	04/03/2025
Path:	/tmp/mipsel.nn.elf
Arguments:	-
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Process Activities

Process Forked

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: mipsel.nn.elf PID: 5464, Parent PID: 5462

General

Start time (UTC):	08:29:30
Start date (UTC):	04/03/2025
Path:	/tmp/mipsel.nn.elf
Arguments:	-
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Prctl Requested

Thread Sleep

Chronological Activities

Analysis Process: udisksd PID: 5449, Parent PID: 802

General

Start time (UTC):	08:29:30
Start date (UTC):	04/03/2025
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: dumpe2fs PID: 5449, Parent PID: 802

General

Start time (UTC):	08:29:30
Start date (UTC):	04/03/2025
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

File Activities

File Opened

File Read

Process Activities

Prctl Requested

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: udisksd PID: 5474, Parent PID: 802

General

Start time (UTC):	08:29:30
Start date (UTC):	04/03/2025
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: dumpe2fs PID: 5474, Parent PID: 802

General

Start time (UTC):	08:29:30
Start date (UTC):	04/03/2025
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report mipsel.nn.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/etc/motd

/tmp/qemu-open.D4d0cv (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

TCP Packets

System Behavior

Analysis Process: mipsel.nn.elf PID: 5439, Parent PID: 5352

General

File Activities

File Opened

File Deleted

File Read

File Written

Directory Enumerated

Symbolic Link Created

Process Activities

Process Forked

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Listening

Socket Connecting

Chronological Activities

Analysis Process: mipsel.nn.elf PID: 5462, Parent PID: 5439

General

Linux Analysis Report
mipsel.nn.elf