Edit tour

Linux Analysis Report
sh4.nn.elf

Overview

General Information

Sample name:	sh4.nn.elf
Analysis ID:	1629086
MD5:	84fbcad4f39c1fb526df73f649edcc59
SHA1:	7954026aa7dbeabaf724b00d7d59dd1141dc3cec
SHA256:	13c19351a88af1d6336cd59bb80b0ab5bb659f857db803de6e96b384196571ac
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	64
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Mirai

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample has stripped symbol table

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1629086
Start date and time:	2025-03-04 11:47:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	sh4.nn.elf
Detection:	MAL
Classification:	mal64.troj.linELF@0/2@0/0

Runtime Messages

Command:	/tmp/sh4.nn.elf
PID:	6240
Exit Code:	139
Exit Code Info:	SIGSEGV (11) Segmentation fault invalid memory reference
Killed:	False
Standard Output:
Standard Error:	qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Process Tree

system is lnxubuntu20

sh4.nn.elf (PID: 6240, Parent: 6159, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/sh4.nn.elf

sh4.nn.elf New Fork (PID: 6262, Parent: 6240)

sh4.nn.elf New Fork (PID: 6264, Parent: 6262)

udisksd New Fork (PID: 6250, Parent: 799)

dumpe2fs (PID: 6250, Parent: 799, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

udisksd New Fork (PID: 6299, Parent: 799)

dumpe2fs (PID: 6299, Parent: 799, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
sh4.nn.elf	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6240.1.00007f13a4400000.00007f13a4417000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: sh4.nn.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: sh4.nn.elf

ReversingLabs: Detection: 44%

Source: global traffic

TCP traffic: 192.168.2.23:58504 -> 176.65.134.15:38242

Source: /tmp/sh4.nn.elf (PID: 6240)

Socket: 127.0.0.1:38242

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal64.troj.linELF@0/2@0/0

Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6351/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6350/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6353/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6352/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6278/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6299/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6277/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6354/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6279/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6326/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6348/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6325/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6347/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6327/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6349/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6065/cmdline	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6285/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6340/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6284/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6361/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6287/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6320/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6342/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6286/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6341/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6322/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6344/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6288/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6321/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6343/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6324/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6346/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6323/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6345/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6281/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6280/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6283/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6282/status	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/sh4.nn.elf (PID: 6264)	File opened: /proc/6339/status	Jump to behavior

Source: sh4.nn.elf

Submission file: segment LOAD with 7.0008 entropy (max. 8.0)

Source: /tmp/sh4.nn.elf (PID: 6240)

Queries kernel information via 'uname':

Jump to behavior

Source: sh4.nn.elf, 6240.1.0000563938c67000.0000563938ceb000.rw-.sdmp	Binary or memory string: /sh4/usr/bin/vmtoolsd
Source: sh4.nn.elf, 6240.1.00007ffc6885c000.00007ffc6887d000.rw-.sdmp	Binary or memory string: nx86_64/usr/bin/qemu-sh4/tmp/sh4.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sh4.nn.elf
Source: sh4.nn.elf, 6240.1.00007ffc6885c000.00007ffc6887d000.rw-.sdmp	Binary or memory string: /qemu-open.XXXXX
Source: sh4.nn.elf, 6240.1.00007ffc6885c000.00007ffc6887d000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: sh4.nn.elf, 6240.1.0000563938c67000.0000563938ceb000.rw-.sdmp	Binary or memory string: /usr/bin/vmtoolsd
Source: sh4.nn.elf, 6240.1.00007ffc6885c000.00007ffc6887d000.rw-.sdmp	Binary or memory string: p59V/tmp/qemu-open.J5uaI2
Source: sh4.nn.elf, 6240.1.00007ffc6885c000.00007ffc6887d000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.J5uaI2
Source: sh4.nn.elf, 6240.1.0000563938c67000.0000563938ceb000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: sh4.nn.elf, 6240.1.0000563938c67000.0000563938ceb000.rw-.sdmp	Binary or memory string: 89VDisplayText!/usr/bin/vmtoolsd
Source: sh4.nn.elf, 6240.1.0000563938c67000.0000563938ceb000.rw-.sdmp	Binary or memory string: 89V5!/etc/qemu-binfmt/sh4
Source: sh4.nn.elf, 6240.1.00007ffc6885c000.00007ffc6887d000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Source: sh4.nn.elf, 6240.1.00007ffc6885c000.00007ffc6887d000.rw-.sdmp	Binary or memory string: /qemu-open.XXXXXSXPF

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: sh4.nn.elf, type: SAMPLE
Source: Yara match	File source: 6240.1.00007f13a4400000.00007f13a4417000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: sh4.nn.elf, type: SAMPLE
Source: Yara match	File source: 6240.1.00007f13a4400000.00007f13a4417000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Obfuscated Files or Information	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
sh4.nn.elf	45%	ReversingLabs	Linux.Exploit.Mirai
sh4.nn.elf	100%	Avira	EXP/ELF.Mirai.W

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
176.65.134.15	unknown	Germany	56325	DIOGELO-ASGB	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
176.65.134.15	powerpc.nn.elf	Get hash	malicious	Mirai	Browse
	mipsel.nn.elf	Get hash	malicious	Mirai	Browse
	x86_32.nn.elf	Get hash	malicious	Mirai	Browse
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse
	sparc.nn.elf	Get hash	malicious	Mirai	Browse
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse
	powerpc.nn.elf	Get hash	malicious	Mirai	Browse
	mipsel.nn.elf	Get hash	malicious	Mirai	Browse
	x86_32.nn.elf	Get hash	malicious	Mirai	Browse
	mipsel.nn.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
91.189.91.43	Mozi.m.elf	Get hash	malicious	Unknown	Browse
	cbr.m68k.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	cbr.sh4.elf	Get hash	malicious	Mirai	Browse
	bin.sh.elf	Get hash	malicious	Unknown	Browse
	cbr.arm5.elf	Get hash	malicious	Mirai	Browse
	cbr.ppc.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
91.189.91.42	Mozi.m.elf	Get hash	malicious	Unknown	Browse
	cbr.m68k.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	cbr.sh4.elf	Get hash	malicious	Mirai	Browse
	bin.sh.elf	Get hash	malicious	Unknown	Browse
	cbr.arm5.elf	Get hash	malicious	Mirai	Browse
	cbr.ppc.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	cbr.arc.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	Mozi.m.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	cbr.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	cbr.arm7.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	jfeeps.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	185.125.190.26
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	cbr.sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	bin.sh.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
CANONICAL-ASGB	cbr.arc.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	Mozi.m.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	cbr.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	cbr.arm7.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	jfeeps.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	185.125.190.26
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	cbr.sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	bin.sh.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
DIOGELO-ASGB	powerpc.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	mipsel.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	x86_32.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	sparc.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	powerpc.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	mipsel.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	x86_32.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	mipsel.nn.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	176.65.134.15
INIT7CH	Mozi.m.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	cbr.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	cbr.sh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	bin.sh.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	cbr.arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	cbr.ppc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/etc/motd

Download File

Process:	/tmp/sh4.nn.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	53
Entropy (8bit):	3.871459242626451
Encrypted:	false
SSDEEP:	3:yGKtARxFQFrgBJ4BJ+3e:dQ0EcHG2e
MD5:	2BD9B4BE30579E633FC0191AA93DF486
SHA1:	7D63A9BD9662E86666B27C1B50DB8E7370C624FF
SHA-256:	64DC39F3004DC93C9FC4F1467B4807F2D8E3EB0BFA96B15C19CD8E7D6FA77A1D
SHA-512:	AE6DD7B39191354CF43CF65E517460D7D4C61B8F5C08E33E6CA3C451DC7CAB4DE89F33934C89396B80F1AADE0A4E2571BD5AE8B76EF80B737D4588703D2814D5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	gorilla botnet is on the device ur not a cat go away.

/tmp/qemu-open.J5uaI2 (deleted)

Download File

Process:	/tmp/sh4.nn.elf
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.625
Encrypted:	false
SSDEEP:	3:TgKhiln:TgKEn
MD5:	AA13A1788DEE62AD7B81E381463BF8D7
SHA1:	0E21290B03BAD90EC3B1D5638F84929E822F6AAE
SHA-256:	53D5AB596D45FDDA9C031F87D2CC18EEBF3710689256F65DA7577E20EB59AEEA
SHA-512:	3E78B3236C5696912F507060451E200251009DB6DF3D5CE0CDD4F1108FB600A3FB768C811ED6700D48890651DE1B6A7507AC311F2BAC717C3E9B333BA94E0140
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	/tmp/sh4.nn.elf.

Static File Info

General

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.907444163710842
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	sh4.nn.elf
File size:	96'032 bytes
MD5:	84fbcad4f39c1fb526df73f649edcc59
SHA1:	7954026aa7dbeabaf724b00d7d59dd1141dc3cec
SHA256:	13c19351a88af1d6336cd59bb80b0ab5bb659f857db803de6e96b384196571ac
SHA512:	d38a23c2eb77ac7f59d9ef07d5abe3939ea1f6a4501c6e325ef26b9fafeed3a4f163672515ef2e2c8977d9e83c075c802b82a701e9715e407ed492c077e55712
SSDEEP:	1536:lGah9WvebPKFZvJkchfwLL3fyAYXCISz/5dmKTkfq7m9DfYCPdgRW38:RwFjkD6AYSIq5dZTdGDfY+38
TLSH:	F893AE37C8255E84E0998AB0A4F09FBBA753A554815F1FB619E6C7398083DCCB64E3F4
File Content Preview:	.ELF.....................@.4...hu......4. ...(...............@...@..i...i...............p...pB..pB.$...dj..........Q.td............................././"O.n........#.@........#.*@.L...o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	95592
Section Header Size:	40
Number of Section Headers:	11
Header String Table Index:	10

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0x14d00	0x0	0x6	AX	32
.fini	PROGBITS	0x414de0	0x14de0	0x24	0x0	0x6	AX	4
.rodata	PROGBITS	0x414e04	0x14e04	0x1ba8	0x0	0x2	A	4
.ctors	PROGBITS	0x427000	0x17000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x427008	0x17008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x427014	0x17014	0x500	0x0	0x3	WA	4
.got	PROGBITS	0x427514	0x17514	0x10	0x4	0x3	WA	4
.bss	NOBITS	0x427524	0x17524	0x6540	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x17524	0x43	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x169ac	0x169ac	7.0008	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x17000	0x427000	0x427000	0x524	0x6a64	4.5633	0x6	RW	0x10000	.ctors .dtors .data .got .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 416
• 38242 undefined
• 443 (HTTPS)
• 80 (HTTP)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 4, 2025 11:48:46.564539909 CET	58504	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:46.570065975 CET	38242	58504	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:46.570106983 CET	58504	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:46.570905924 CET	58504	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:46.576488018 CET	38242	58504	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:47.266103983 CET	58504	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:47.311935902 CET	38242	58504	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:48.239993095 CET	42836	443	192.168.2.23	91.189.91.43
Mar 4, 2025 11:48:48.270494938 CET	58506	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:48.275825977 CET	38242	58506	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:48.275893927 CET	58506	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:48.275928974 CET	58506	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:48.281045914 CET	38242	58506	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:48.782716036 CET	58506	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:48.832318068 CET	38242	58506	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:49.775784016 CET	42516	80	192.168.2.23	109.202.202.202
Mar 4, 2025 11:48:49.789567947 CET	58508	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:49.794815063 CET	38242	58508	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:49.796700954 CET	58508	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:49.798387051 CET	58508	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:49.803503036 CET	38242	58508	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:50.172380924 CET	38242	58504	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:50.172494888 CET	58504	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:50.307466984 CET	58508	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:50.355878115 CET	38242	58508	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:51.329855919 CET	58510	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:51.335777998 CET	38242	58510	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:51.335824966 CET	58510	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:51.335927963 CET	58510	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:51.341737032 CET	38242	58510	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:51.876765966 CET	58510	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:51.889811993 CET	38242	58506	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:51.889879942 CET	58506	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:51.927841902 CET	38242	58510	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:52.879440069 CET	58512	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:52.884604931 CET	38242	58512	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:52.884701967 CET	58512	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:52.884721994 CET	58512	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:52.889830112 CET	38242	58512	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:52.961581945 CET	38242	58510	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:52.961673021 CET	58510	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:53.393147945 CET	58512	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:53.403877020 CET	38242	58508	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:53.403976917 CET	58508	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:53.443943024 CET	38242	58512	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:53.496084929 CET	38242	58512	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:53.496166945 CET	58512	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:54.394622087 CET	58514	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:54.401418924 CET	38242	58514	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:54.401529074 CET	58514	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:54.401597023 CET	58514	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:54.408035040 CET	38242	58514	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:54.915502071 CET	58514	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:54.967861891 CET	38242	58514	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:55.916363955 CET	58516	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:55.922014952 CET	38242	58516	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:55.922091007 CET	58516	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:55.922148943 CET	58516	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:55.928693056 CET	38242	58516	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:56.425937891 CET	58516	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:56.473794937 CET	38242	58516	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:56.535223961 CET	38242	58516	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:56.535321951 CET	58516	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:57.427265882 CET	58518	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:57.432523012 CET	38242	58518	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:57.432629108 CET	58518	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:57.432682037 CET	58518	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:57.437669039 CET	38242	58518	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:57.939656019 CET	58518	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:57.987860918 CET	38242	58518	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:58.044487000 CET	38242	58518	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:58.044548035 CET	58518	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:58.940603971 CET	58520	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:58.946608067 CET	38242	58520	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:58.946696043 CET	58520	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:58.946726084 CET	58520	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:58.951738119 CET	38242	58520	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:59.450697899 CET	58520	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:48:59.499855995 CET	38242	58520	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:59.545388937 CET	38242	58520	176.65.134.15	192.168.2.23
Mar 4, 2025 11:48:59.545470953 CET	58520	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:00.451637030 CET	58522	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:00.456891060 CET	38242	58522	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:00.456984997 CET	58522	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:00.457024097 CET	58522	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:00.462039948 CET	38242	58522	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:00.960599899 CET	58522	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:01.007935047 CET	38242	58522	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:01.961288929 CET	58524	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:01.966599941 CET	38242	58524	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:01.966670036 CET	58524	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:01.966713905 CET	58524	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:01.971726894 CET	38242	58524	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:02.471945047 CET	58524	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:02.525451899 CET	38242	58524	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:02.581602097 CET	38242	58524	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:02.581705093 CET	58524	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:02.833992958 CET	43928	443	192.168.2.23	91.189.91.42
Mar 4, 2025 11:49:03.473104954 CET	58526	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:03.478245974 CET	38242	58526	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:03.478389025 CET	58526	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:03.478530884 CET	58526	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:03.483577013 CET	38242	58526	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:03.984122038 CET	58526	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:04.032407045 CET	38242	58514	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:04.032586098 CET	58514	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:04.035824060 CET	38242	58526	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:04.076080084 CET	38242	58526	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:04.076195002 CET	58526	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:04.985554934 CET	58528	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:04.990827084 CET	38242	58528	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:04.990926027 CET	58528	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:04.990953922 CET	58528	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:04.996042013 CET	38242	58528	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:05.523571968 CET	58528	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:05.572024107 CET	38242	58528	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:06.526034117 CET	58530	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:06.531255007 CET	38242	58530	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:06.531342030 CET	58530	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:06.531377077 CET	58530	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:06.536398888 CET	38242	58530	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:07.037123919 CET	58530	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:07.087893009 CET	38242	58530	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:07.140101910 CET	38242	58530	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:07.140170097 CET	58530	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:08.038259983 CET	58532	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:08.043521881 CET	38242	58532	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:08.043603897 CET	58532	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:08.043631077 CET	58532	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:08.048818111 CET	38242	58532	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:08.547940016 CET	58532	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:08.595938921 CET	38242	58532	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:08.664256096 CET	38242	58532	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:08.664346933 CET	58532	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:09.551618099 CET	58534	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:09.559097052 CET	38242	58534	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:09.559195995 CET	58534	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:09.559253931 CET	58534	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:09.566134930 CET	38242	58534	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:10.062897921 CET	38242	58522	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:10.063007116 CET	58522	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:10.073760986 CET	58534	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:10.119874954 CET	38242	58534	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:11.093513012 CET	58536	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:11.098676920 CET	38242	58536	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:11.098731995 CET	58536	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:11.117468119 CET	58536	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:11.122507095 CET	38242	58536	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:11.717463017 CET	58536	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:11.763854027 CET	38242	58536	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:12.738250971 CET	58538	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:12.743391991 CET	38242	58538	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:12.743510008 CET	58538	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:12.743563890 CET	58538	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:12.748675108 CET	38242	58538	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:13.286618948 CET	58538	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:13.331819057 CET	38242	58538	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:13.342097044 CET	38242	58538	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:13.342176914 CET	58538	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:14.288674116 CET	58540	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:14.293852091 CET	38242	58540	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:14.293931961 CET	58540	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:14.293973923 CET	58540	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:14.298913956 CET	38242	58540	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:14.797200918 CET	58540	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:14.847824097 CET	38242	58540	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:14.906975985 CET	38242	58540	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:14.907032013 CET	58540	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:15.116298914 CET	42836	443	192.168.2.23	91.189.91.43
Mar 4, 2025 11:49:15.813978910 CET	58542	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:15.819139004 CET	38242	58542	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:15.819212914 CET	58542	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:15.819262981 CET	58542	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:15.824259043 CET	38242	58542	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:16.324964046 CET	58542	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:16.371938944 CET	38242	58542	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:16.431776047 CET	38242	58542	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:16.431844950 CET	58542	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:17.337841988 CET	58544	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:17.343058109 CET	38242	58544	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:17.343159914 CET	58544	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:17.343159914 CET	58544	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:17.348176956 CET	38242	58544	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:17.866211891 CET	58544	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:17.915815115 CET	38242	58544	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:17.954802036 CET	38242	58544	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:17.954933882 CET	58544	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:18.901457071 CET	58546	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:18.906564951 CET	38242	58546	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:18.906652927 CET	58546	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:18.925446987 CET	58546	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:18.931467056 CET	38242	58546	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:19.211699009 CET	42516	80	192.168.2.23	109.202.202.202
Mar 4, 2025 11:49:19.485459089 CET	58546	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:19.535877943 CET	38242	58546	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:19.546078920 CET	38242	58546	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:19.546142101 CET	58546	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:20.505865097 CET	58548	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:20.511116982 CET	38242	58548	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:20.511233091 CET	58548	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:20.511248112 CET	58548	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:20.516321898 CET	38242	58548	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:21.019078016 CET	58548	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:21.067837000 CET	38242	58548	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:21.127166986 CET	38242	58548	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:21.127338886 CET	58548	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:22.020262003 CET	58550	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:22.025403976 CET	38242	58550	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:22.025473118 CET	58550	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:22.025501966 CET	58550	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:22.030575037 CET	38242	58550	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:22.529488087 CET	58550	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:22.575884104 CET	38242	58550	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:22.638381004 CET	38242	58550	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:22.638457060 CET	58550	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:23.530983925 CET	58552	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:23.536132097 CET	38242	58552	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:23.536227942 CET	58552	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:23.536293030 CET	58552	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:23.541307926 CET	38242	58552	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:24.041690111 CET	58552	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:24.087950945 CET	38242	58552	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:24.137552977 CET	38242	58552	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:24.137670994 CET	58552	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:25.045206070 CET	58554	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:25.052675009 CET	38242	58554	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:25.052783966 CET	58554	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:25.052810907 CET	58554	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:25.060266018 CET	38242	58554	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:25.597156048 CET	58554	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:25.647900105 CET	38242	58554	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:25.756145000 CET	38242	58554	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:25.756258011 CET	58554	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:26.368194103 CET	38242	58528	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:26.368269920 CET	58528	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:26.598320961 CET	58556	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:26.603429079 CET	38242	58556	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:26.603529930 CET	58556	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:26.603562117 CET	58556	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:26.608594894 CET	38242	58556	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:27.108354092 CET	58556	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:27.159881115 CET	38242	58556	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:27.201261044 CET	38242	58556	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:27.201430082 CET	58556	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:28.109992981 CET	58558	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:28.115215063 CET	38242	58558	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:28.115329981 CET	58558	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:28.115372896 CET	58558	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:28.123610973 CET	38242	58558	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:28.619414091 CET	58558	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:28.672250986 CET	38242	58558	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:29.620888948 CET	58560	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:29.625989914 CET	38242	58560	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:29.626059055 CET	58560	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:29.626085043 CET	58560	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:29.631134033 CET	38242	58560	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:30.131089926 CET	58560	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:30.179986000 CET	38242	58560	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:30.223866940 CET	38242	58560	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:30.223965883 CET	58560	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:30.949003935 CET	38242	58534	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:30.949171066 CET	58534	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:31.133110046 CET	58562	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:31.138299942 CET	38242	58562	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:31.138402939 CET	58562	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:31.138402939 CET	58562	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:31.143482924 CET	38242	58562	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:31.649632931 CET	58562	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:31.695926905 CET	38242	58562	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:31.758476019 CET	38242	58562	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:31.758574963 CET	58562	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:32.461930990 CET	38242	58536	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:32.462025881 CET	58536	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:32.656306028 CET	58564	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:32.661509991 CET	38242	58564	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:32.661571980 CET	58564	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:32.661593914 CET	58564	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:32.666743040 CET	38242	58564	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:33.167263985 CET	58564	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:33.220127106 CET	38242	58564	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:33.259505987 CET	38242	58564	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:33.259573936 CET	58564	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:34.168123007 CET	58566	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:34.173175097 CET	38242	58566	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:34.173258066 CET	58566	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:34.173329115 CET	58566	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:34.178647041 CET	38242	58566	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:34.676776886 CET	58566	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:34.725480080 CET	38242	58566	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:34.779397011 CET	38242	58566	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:34.779472113 CET	58566	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:35.677915096 CET	58568	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:35.683008909 CET	38242	58568	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:35.683063984 CET	58568	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:35.683104992 CET	58568	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:35.688175917 CET	38242	58568	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:36.187961102 CET	58568	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:36.239825964 CET	38242	58568	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:36.298234940 CET	38242	58568	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:36.298302889 CET	58568	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:37.189213037 CET	58570	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:37.196091890 CET	38242	58570	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:37.196171999 CET	58570	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:37.196208000 CET	58570	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:37.203059912 CET	38242	58570	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:37.705095053 CET	58570	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:37.755836964 CET	38242	58570	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:37.810136080 CET	38242	58570	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:37.810220957 CET	58570	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:38.713979006 CET	58572	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:38.719350100 CET	38242	58572	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:38.719428062 CET	58572	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:38.719445944 CET	58572	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:38.724566936 CET	38242	58572	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:39.224605083 CET	58572	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:39.273422003 CET	38242	58572	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:39.314922094 CET	38242	58572	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:39.315038919 CET	58572	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:40.225452900 CET	58574	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:40.230700970 CET	38242	58574	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:40.230830908 CET	58574	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:40.230865955 CET	58574	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:40.235975981 CET	38242	58574	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:40.735912085 CET	58574	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:40.787873983 CET	38242	58574	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:40.868735075 CET	38242	58574	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:40.868830919 CET	58574	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:41.743575096 CET	58576	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:41.748711109 CET	38242	58576	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:41.749161005 CET	58576	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:41.752676964 CET	58576	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:41.757683039 CET	38242	58576	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:42.259803057 CET	58576	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:42.311882973 CET	38242	58576	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:42.363017082 CET	38242	58576	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:42.363156080 CET	58576	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:43.261881113 CET	58578	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:43.267050982 CET	38242	58578	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:43.267159939 CET	58578	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:43.267333984 CET	58578	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:43.272363901 CET	38242	58578	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:43.774256945 CET	58578	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:43.788362980 CET	43928	443	192.168.2.23	91.189.91.42
Mar 4, 2025 11:49:43.819864988 CET	38242	58578	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:43.869446993 CET	38242	58578	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:43.869616985 CET	58578	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:44.775405884 CET	58580	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:44.780630112 CET	38242	58580	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:44.780735970 CET	58580	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:44.780759096 CET	58580	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:44.785764933 CET	38242	58580	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:45.287224054 CET	58580	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:45.339873075 CET	38242	58580	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:45.391896963 CET	38242	58580	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:45.391997099 CET	58580	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:45.831157923 CET	38242	58558	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:45.831284046 CET	58558	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:46.288563967 CET	58582	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:46.293695927 CET	38242	58582	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:46.293796062 CET	58582	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:46.293828964 CET	58582	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:46.298823118 CET	38242	58582	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:46.798362017 CET	58582	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:46.843786001 CET	38242	58582	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:46.894310951 CET	38242	58582	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:46.894419909 CET	58582	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:47.799459934 CET	58584	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:47.804503918 CET	38242	58584	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:47.804625988 CET	58584	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:47.804625988 CET	58584	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:47.809648991 CET	38242	58584	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:48.308844090 CET	58584	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:48.355813980 CET	38242	58584	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:48.401834011 CET	38242	58584	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:48.401943922 CET	58584	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:49.310508013 CET	58586	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:49.315596104 CET	38242	58586	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:49.315730095 CET	58586	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:49.315778017 CET	58586	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:49.320835114 CET	38242	58586	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:49.824026108 CET	58586	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:49.871773005 CET	38242	58586	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:49.918806076 CET	38242	58586	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:49.918951988 CET	58586	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:50.825735092 CET	58588	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:50.830878019 CET	38242	58588	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:50.831058025 CET	58588	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:50.831078053 CET	58588	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:50.836235046 CET	38242	58588	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:51.337346077 CET	58588	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:51.388000011 CET	38242	58588	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:52.338521957 CET	58590	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:52.343728065 CET	38242	58590	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:52.343838930 CET	58590	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:52.343902111 CET	58590	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:52.348999977 CET	38242	58590	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:52.851243019 CET	58590	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:52.899823904 CET	38242	58590	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:53.852958918 CET	58592	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:53.858079910 CET	38242	58592	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:53.858189106 CET	58592	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:53.858189106 CET	58592	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:53.863332987 CET	38242	58592	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:54.363759041 CET	58592	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:54.411942005 CET	38242	58592	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:54.435547113 CET	38242	58588	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:54.435825109 CET	58588	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:55.365190983 CET	58594	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:55.370268106 CET	38242	58594	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:55.370383978 CET	58594	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:55.370383978 CET	58594	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:55.375514984 CET	38242	58594	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:55.876221895 CET	58594	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:55.927856922 CET	38242	58594	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:55.988661051 CET	38242	58594	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:55.988792896 CET	58594	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:56.877542973 CET	58596	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:56.882883072 CET	38242	58596	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:56.882951021 CET	58596	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:56.883003950 CET	58596	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:56.888082981 CET	38242	58596	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:57.391138077 CET	58596	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:57.439883947 CET	38242	58596	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:57.470159054 CET	38242	58592	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:57.470293045 CET	58592	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:57.480638981 CET	38242	58596	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:57.480734110 CET	58596	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:58.392642975 CET	58598	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:58.397648096 CET	38242	58598	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:58.397751093 CET	58598	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:58.397790909 CET	58598	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:58.402744055 CET	38242	58598	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:58.904027939 CET	58598	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:58.955790043 CET	38242	58598	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:58.997034073 CET	38242	58598	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:58.997137070 CET	58598	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:59.905985117 CET	58600	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:59.911089897 CET	38242	58600	176.65.134.15	192.168.2.23
Mar 4, 2025 11:49:59.911259890 CET	58600	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:59.911259890 CET	58600	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:49:59.918131113 CET	38242	58600	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:00.418464899 CET	58600	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:00.464107990 CET	38242	58600	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:01.420254946 CET	58602	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:01.425335884 CET	38242	58602	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:01.425508976 CET	58602	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:01.425508976 CET	58602	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:01.430592060 CET	38242	58602	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:01.933305979 CET	58602	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:01.983782053 CET	38242	58602	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:02.064169884 CET	38242	58602	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:02.064291954 CET	58602	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:02.935220003 CET	58604	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:02.940345049 CET	38242	58604	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:02.940511942 CET	58604	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:02.940591097 CET	58604	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:02.945631981 CET	38242	58604	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:03.449148893 CET	58604	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:03.615814924 CET	38242	58604	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:04.450700045 CET	58606	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:04.469870090 CET	38242	58606	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:04.469964981 CET	58606	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:04.470037937 CET	58606	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:04.475999117 CET	38242	58606	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:04.975555897 CET	58606	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:05.027825117 CET	38242	58606	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:05.976910114 CET	58608	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:05.988388062 CET	38242	58608	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:05.988492012 CET	58608	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:05.988554955 CET	58608	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:05.993561983 CET	38242	58608	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:06.494918108 CET	58608	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:06.543812037 CET	38242	58608	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:06.587501049 CET	38242	58608	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:06.587630987 CET	58608	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:07.497116089 CET	58610	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:07.502186060 CET	38242	58610	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:07.502279043 CET	58610	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:07.502326012 CET	58610	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:07.507291079 CET	38242	58610	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:08.009280920 CET	58610	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:08.059892893 CET	38242	58610	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:09.010447979 CET	58612	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:09.015496016 CET	38242	58612	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:09.015573978 CET	58612	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:09.015599012 CET	58612	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:09.020591974 CET	38242	58612	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:09.513994932 CET	38242	58600	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:09.514166117 CET	58600	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:09.523659945 CET	58612	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:09.571877003 CET	38242	58612	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:09.628423929 CET	38242	58612	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:09.628601074 CET	58612	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:10.525053024 CET	58614	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:10.530060053 CET	38242	58614	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:10.530195951 CET	58614	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:10.530195951 CET	58614	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:10.535334110 CET	38242	58614	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:11.036499023 CET	58614	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:11.088197947 CET	38242	58614	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:11.134347916 CET	38242	58614	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:11.134480953 CET	58614	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:12.038837910 CET	58616	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:12.044317007 CET	38242	58616	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:12.044435978 CET	58616	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:12.044469118 CET	58616	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:12.049428940 CET	38242	58616	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:12.549352884 CET	58616	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:12.599834919 CET	38242	58616	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:12.650643110 CET	38242	58616	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:12.650763988 CET	58616	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:13.551968098 CET	58618	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:13.557064056 CET	38242	58618	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:13.557136059 CET	58618	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:13.557171106 CET	58618	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:13.562199116 CET	38242	58618	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:13.732336044 CET	38242	58590	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:13.732467890 CET	58590	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:14.065098047 CET	58618	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:14.077847958 CET	38242	58606	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:14.077927113 CET	58606	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:14.111931086 CET	38242	58618	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:14.159996033 CET	38242	58618	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:14.160140991 CET	58618	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:15.066912889 CET	58620	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:15.072021008 CET	38242	58620	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:15.072113991 CET	58620	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:15.072149038 CET	58620	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:15.077169895 CET	38242	58620	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:15.579068899 CET	58620	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:15.627778053 CET	38242	58620	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:15.670921087 CET	38242	58620	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:15.671026945 CET	58620	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:16.580540895 CET	58622	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:16.585530043 CET	38242	58622	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:16.585712910 CET	58622	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:16.585735083 CET	58622	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:16.590791941 CET	38242	58622	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:17.092364073 CET	58622	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:17.143843889 CET	38242	58622	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:17.198174000 CET	38242	58622	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:17.198291063 CET	58622	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:18.093761921 CET	58624	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:18.098815918 CET	38242	58624	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:18.098901033 CET	58624	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:18.098901033 CET	58624	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:18.103944063 CET	38242	58624	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:18.604219913 CET	58624	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:18.651851892 CET	38242	58624	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:18.695633888 CET	38242	58624	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:18.695760965 CET	58624	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:19.605725050 CET	58626	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:19.610779047 CET	38242	58626	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:19.610841036 CET	58626	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:19.610860109 CET	58626	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:19.615859985 CET	38242	58626	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:20.117047071 CET	58626	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:20.163814068 CET	38242	58626	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:21.132698059 CET	58628	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:21.137717962 CET	38242	58628	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:21.137768030 CET	58628	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:21.145601034 CET	58628	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:21.150568962 CET	38242	58628	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:21.655126095 CET	58628	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:21.703789949 CET	38242	58628	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:21.748795033 CET	38242	58628	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:21.748905897 CET	58628	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:22.656517029 CET	58630	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:22.661674976 CET	38242	58630	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:22.661768913 CET	58630	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:22.661808968 CET	58630	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:22.666766882 CET	38242	58630	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:23.171457052 CET	58630	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:23.354705095 CET	38242	58630	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:23.354846954 CET	58630	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:24.174799919 CET	58632	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:24.180075884 CET	38242	58632	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:24.180155039 CET	58632	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:24.180180073 CET	58632	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:24.188133001 CET	38242	58632	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:24.289580107 CET	38242	58604	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:24.289704084 CET	58604	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:24.686487913 CET	58632	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:24.731779099 CET	38242	58632	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:24.781222105 CET	38242	58632	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:24.781307936 CET	58632	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:25.688160896 CET	58634	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:25.693228960 CET	38242	58634	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:25.693299055 CET	58634	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:25.693361044 CET	58634	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:25.698749065 CET	38242	58634	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:26.199309111 CET	58634	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:26.251776934 CET	38242	58634	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:26.312567949 CET	38242	58634	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:26.312681913 CET	58634	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:27.200745106 CET	58636	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:27.205796957 CET	38242	58636	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:27.205868006 CET	58636	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:27.205895901 CET	58636	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:27.210908890 CET	38242	58636	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:27.713114023 CET	58636	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:27.759756088 CET	38242	58636	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:27.825462103 CET	38242	58636	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:27.825635910 CET	58636	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:28.714344978 CET	58638	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:28.720232010 CET	38242	58638	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:28.720293999 CET	58638	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:28.720310926 CET	58638	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:28.725337029 CET	38242	58638	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:28.869316101 CET	38242	58610	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:28.869436979 CET	58610	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:29.216685057 CET	38242	58626	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:29.216779947 CET	58626	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:29.225161076 CET	58638	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:29.275789976 CET	38242	58638	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:29.334729910 CET	38242	58638	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:29.334867001 CET	58638	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:30.226885080 CET	58640	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:30.231978893 CET	38242	58640	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:30.232089996 CET	58640	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:30.232125998 CET	58640	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:30.237154007 CET	38242	58640	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:30.737021923 CET	58640	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:30.784187078 CET	38242	58640	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:30.845865011 CET	38242	58640	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:30.846020937 CET	58640	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:31.738692999 CET	58642	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:31.744585037 CET	38242	58642	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:31.744697094 CET	58642	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:31.744697094 CET	58642	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:31.749861002 CET	38242	58642	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:32.250948906 CET	58642	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:32.303782940 CET	38242	58642	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:32.340415001 CET	38242	58642	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:32.340559959 CET	58642	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:33.252383947 CET	58644	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:33.257487059 CET	38242	58644	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:33.257591009 CET	58644	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:33.257628918 CET	58644	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:33.262598991 CET	38242	58644	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:33.764758110 CET	58644	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:33.811820984 CET	38242	58644	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:34.766555071 CET	58646	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:34.771620989 CET	38242	58646	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:34.771760941 CET	58646	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:34.771814108 CET	58646	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:34.777669907 CET	38242	58646	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:35.278800011 CET	58646	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:35.327779055 CET	38242	58646	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:35.376920938 CET	38242	58646	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:35.377032042 CET	58646	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:36.280087948 CET	58648	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:36.285351038 CET	38242	58648	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:36.285445929 CET	58648	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:36.285473108 CET	58648	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:36.290527105 CET	38242	58648	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:36.790133953 CET	58648	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:36.839818954 CET	38242	58648	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:36.882885933 CET	38242	58648	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:36.883054018 CET	58648	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:37.791784048 CET	58650	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:37.796844006 CET	38242	58650	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:37.797014952 CET	58650	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:37.797014952 CET	58650	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:37.802021027 CET	38242	58650	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:38.302624941 CET	58650	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:38.347774029 CET	38242	58650	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:39.303757906 CET	58652	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:39.308757067 CET	38242	58652	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:39.308852911 CET	58652	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:39.308912039 CET	58652	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:39.313906908 CET	38242	58652	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:39.814021111 CET	58652	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:39.859839916 CET	38242	58652	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:39.921624899 CET	38242	58652	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:39.921750069 CET	58652	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:40.815372944 CET	58654	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:40.820516109 CET	38242	58654	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:40.820615053 CET	58654	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:40.820637941 CET	58654	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:40.825588942 CET	38242	58654	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:41.326824903 CET	58654	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:41.379786968 CET	38242	58654	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:41.430066109 CET	38242	58654	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:41.430160046 CET	58654	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:42.328614950 CET	58656	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:42.333714008 CET	38242	58656	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:42.333806038 CET	58656	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:42.333827019 CET	58656	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:42.338819981 CET	38242	58656	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:42.840619087 CET	58656	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:42.955848932 CET	38242	58656	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:43.842458010 CET	58658	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:43.847640038 CET	38242	58658	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:43.847795963 CET	58658	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:43.847795963 CET	58658	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:43.852859020 CET	38242	58658	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:44.353827000 CET	58658	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:44.399815083 CET	38242	58658	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:44.444920063 CET	38242	58658	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:44.445013046 CET	58658	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:45.355856895 CET	58660	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:45.361318111 CET	38242	58660	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:45.361439943 CET	58660	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:45.361526966 CET	58660	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:45.366539955 CET	38242	58660	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:45.869664907 CET	58660	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:45.919781923 CET	38242	58660	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:46.871512890 CET	58662	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:46.876538992 CET	38242	58662	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:46.876667023 CET	58662	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:46.876703024 CET	58662	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:46.881776094 CET	38242	58662	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:47.383054018 CET	58662	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:47.406542063 CET	38242	58650	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:47.406778097 CET	58650	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:47.435812950 CET	38242	58662	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:47.477375031 CET	38242	58662	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:47.477624893 CET	58662	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:48.384651899 CET	58664	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:48.389800072 CET	38242	58664	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:48.389904976 CET	58664	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:48.389938116 CET	58664	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:48.395086050 CET	38242	58664	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:48.894788980 CET	58664	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:48.943794966 CET	38242	58664	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:48.994113922 CET	38242	58664	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:48.994225979 CET	58664	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:49.896275043 CET	58666	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:49.901379108 CET	38242	58666	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:49.901462078 CET	58666	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:49.901485920 CET	58666	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:49.906586885 CET	38242	58666	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:50.407452106 CET	58666	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:50.455862999 CET	38242	58666	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:50.506613016 CET	38242	58666	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:50.506752968 CET	58666	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:51.408970118 CET	58668	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:51.414333105 CET	38242	58668	176.65.134.15	192.168.2.23
Mar 4, 2025 11:50:51.414469004 CET	58668	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:51.414506912 CET	58668	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 11:50:51.419537067 CET	38242	58668	176.65.134.15	192.168.2.23

System Behavior

Analysis Process: sh4.nn.elf PID: 6240, Parent PID: 6159

General

Start time (UTC):	10:48:45
Start date (UTC):	04/03/2025
Path:	/tmp/sh4.nn.elf
Arguments:	/tmp/sh4.nn.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

File Activities

File Opened

File Deleted

File Read

File Written

Directory Enumerated

Symbolic Link Created

Process Activities

Process Forked

Signal Sent

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Listening

Socket Connecting

Chronological Activities

Analysis Process: sh4.nn.elf PID: 6262, Parent PID: 6240

General

Start time (UTC):	10:48:45
Start date (UTC):	04/03/2025
Path:	/tmp/sh4.nn.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Process Activities

Process Forked

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: sh4.nn.elf PID: 6264, Parent PID: 6262

General

Start time (UTC):	10:48:45
Start date (UTC):	04/03/2025
Path:	/tmp/sh4.nn.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Prctl Requested

Thread Sleep

Chronological Activities

Analysis Process: udisksd PID: 6250, Parent PID: 799

General

Start time (UTC):	10:48:45
Start date (UTC):	04/03/2025
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: dumpe2fs PID: 6250, Parent PID: 799

General

Start time (UTC):	10:48:45
Start date (UTC):	04/03/2025
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

File Activities

File Opened

File Read

Process Activities

Prctl Requested

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: udisksd PID: 6299, Parent PID: 799

General

Start time (UTC):	10:48:46
Start date (UTC):	04/03/2025
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: dumpe2fs PID: 6299, Parent PID: 799

General

Start time (UTC):	10:48:46
Start date (UTC):	04/03/2025
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report sh4.nn.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/etc/motd

/tmp/qemu-open.J5uaI2 (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: sh4.nn.elf PID: 6240, Parent PID: 6159

General

File Activities

File Opened

File Deleted

File Read

File Written

Directory Enumerated

Symbolic Link Created

Process Activities

Process Forked

Signal Sent

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Listening

Socket Connecting

Linux Analysis Report
sh4.nn.elf