Edit tour

Linux Analysis Report
arm.nn.elf

Overview

General Information

Sample name:	arm.nn.elf
Analysis ID:	1629126
MD5:	74b02fbb8c5ed881afc8022205a864f8
SHA1:	ddafe82369e23d40904f97972eb8a82831549218
SHA256:	01974cffa417852147e59d6f15f1bbf6b04807c93121b4088e4ab0e50818c494
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	64
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Mirai

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample has stripped symbol table

Sample listens on a socket

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1629126
Start date and time:	2025-03-04 12:13:49 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	arm.nn.elf
Detection:	MAL
Classification:	mal64.troj.linELF@0/2@2/0

Runtime Messages

Command:	/tmp/arm.nn.elf
PID:	5814
Exit Code:	139
Exit Code Info:	SIGSEGV (11) Segmentation fault invalid memory reference
Killed:	False
Standard Output:
Standard Error:	qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Process Tree

system is lnxubuntu20

arm.nn.elf (PID: 5814, Parent: 5738, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm.nn.elf

arm.nn.elf New Fork (PID: 5836, Parent: 5814)

arm.nn.elf New Fork (PID: 5838, Parent: 5836)

udisksd New Fork (PID: 5825, Parent: 803)

dumpe2fs (PID: 5825, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

udisksd New Fork (PID: 5884, Parent: 803)

dumpe2fs (PID: 5884, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
arm.nn.elf	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
5814.1.00007f8350017000.00007f8350031000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Persistence and Installation Behavior
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: arm.nn.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: arm.nn.elf	Virustotal: Detection: 41%			Perma Link
Source: arm.nn.elf	ReversingLabs: Detection: 50%

Source: global traffic

TCP traffic: 192.168.2.15:44056 -> 176.65.134.15:38242

Source: /tmp/arm.nn.elf (PID: 5814)

Socket: 127.0.0.1:38242

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal64.troj.linELF@0/2@2/0

Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5881/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5860/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5861/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5840/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5862/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5884/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5917/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5918/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5919/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5852/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5655/cmdline	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5853/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5930/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5854/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5931/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5855/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5856/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5857/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5858/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5859/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5870/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5871/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5926/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5927/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5928/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5929/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5863/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5864/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5865/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5920/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5866/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5921/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5867/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5922/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5868/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5923/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5869/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5924/status	Jump to behavior
Source: /tmp/arm.nn.elf (PID: 5838)	File opened: /proc/5925/status	Jump to behavior

Source: /tmp/arm.nn.elf (PID: 5814)

Queries kernel information via 'uname':

Jump to behavior

Source: arm.nn.elf, 5814.1.00007ffc04ee9000.00007ffc04f0a000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.CmLUDR
Source: arm.nn.elf, 5814.1.000055c4bc7b6000.000055c4bc905000.rw-.sdmp	Binary or memory string: U/arm/ro10 /proc/1585/exe0!/usr/bin1/proc/803/exe/arm/usr/bin0!/usr/bin/VGAuthService1/usr/bin/xiccd/arm/sr10!/usr/bin/gnome-shell!/proc/724/exe1/proc/3469/exe/arm/ro10!/proc/1553/exe0!/usr/bin/vmtoolsd1/proc/3316/exe/arm/10!/proc/1514/exe0!/proc/740/exe1/usr/libexec/ibus-memconf
Source: arm.nn.elf, 5814.1.00007ffc04ee9000.00007ffc04f0a000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.CmLUDR
Source: arm.nn.elf, 5814.1.000055c4bc7b6000.000055c4bc905000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: arm.nn.elf, 5814.1.000055c4bc7b6000.000055c4bc905000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmtP /proc/5798/exefce4/paneQ
Source: arm.nn.elf, 5814.1.00007ffc04ee9000.00007ffc04f0a000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm.nn.elf
Source: arm.nn.elf, 5814.1.000055c4bc7b6000.000055c4bc905000.rw-.sdmp	Binary or memory string: /usr/bin/vmtoolsd
Source: arm.nn.elf, 5814.1.000055c4bc7b6000.000055c4bc905000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmtP
Source: arm.nn.elf, 5814.1.000055c4bc7b6000.000055c4bc905000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: arm.nn.elf, 5814.1.00007ffc04ee9000.00007ffc04f0a000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: arm.nn.elf, 5814.1.00007ffc04ee9000.00007ffc04f0a000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: arm.nn.elf, type: SAMPLE
Source: Yara match	File source: 5814.1.00007f8350017000.00007f8350031000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: arm.nn.elf, type: SAMPLE
Source: Yara match	File source: 5814.1.00007f8350017000.00007f8350031000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
arm.nn.elf	42%	Virustotal		Browse
arm.nn.elf	50%	ReversingLabs	Linux.Backdoor.Mirai
arm.nn.elf	100%	Avira	EXP/ELF.Mirai.W

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	unknown	unknown	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
176.65.134.15	unknown	Germany		56325	DIOGELO-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
176.65.134.15	arm7.nn.elf	Get hash	malicious	Mirai	Browse
	sh4.nn.elf	Get hash	malicious	Mirai	Browse
	powerpc.nn.elf	Get hash	malicious	Mirai	Browse
	mipsel.nn.elf	Get hash	malicious	Mirai	Browse
	x86_32.nn.elf	Get hash	malicious	Mirai	Browse
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse
	sparc.nn.elf	Get hash	malicious	Mirai	Browse
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse
	powerpc.nn.elf	Get hash	malicious	Mirai	Browse
	mipsel.nn.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIOGELO-ASGB	arm7.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	sh4.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	powerpc.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	mipsel.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	x86_32.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	sparc.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	powerpc.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	mipsel.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/etc/motd

Download File

Process:	/tmp/arm.nn.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	53
Entropy (8bit):	3.871459242626451
Encrypted:	false
SSDEEP:	3:yGKtARxFQFrgBJ4BJ+3e:dQ0EcHG2e
MD5:	2BD9B4BE30579E633FC0191AA93DF486
SHA1:	7D63A9BD9662E86666B27C1B50DB8E7370C624FF
SHA-256:	64DC39F3004DC93C9FC4F1467B4807F2D8E3EB0BFA96B15C19CD8E7D6FA77A1D
SHA-512:	AE6DD7B39191354CF43CF65E517460D7D4C61B8F5C08E33E6CA3C451DC7CAB4DE89F33934C89396B80F1AADE0A4E2571BD5AE8B76EF80B737D4588703D2814D5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	gorilla botnet is on the device ur not a cat go away.

/tmp/qemu-open.CmLUDR (deleted)

Download File

Process:	/tmp/arm.nn.elf
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.5
Encrypted:	false
SSDEEP:	3:Tg7/LsDln:Tgs5n
MD5:	5A9E68CC61A24B23E7CE850CBE55CD38
SHA1:	7D53E57B760618566E5B635118604478EE1175B1
SHA-256:	300279D18C7FC46D9F271DFDD3D803874D1B222B3512385D9FFFEED712EF1D97
SHA-512:	09970D3B321DA48BAEB46B368CF5C40CCB90A0EB76300D7F5B03441FE9161AA5FD26C152CE83DC681397FD2FA81B6AD824092660285B1562F4D326C60517C7F3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	/tmp/arm.nn.elf.

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.174847795303845
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	arm.nn.elf
File size:	104'748 bytes
MD5:	74b02fbb8c5ed881afc8022205a864f8
SHA1:	ddafe82369e23d40904f97972eb8a82831549218
SHA256:	01974cffa417852147e59d6f15f1bbf6b04807c93121b4088e4ab0e50818c494
SHA512:	bb5f5be35984076b87422801df2b6a2ffe4b4f0095c350c7fccc1c98fca23a9b25f8f5d245a2c2f9cfd8000d3c5c3570110da398c9091ef445a8ff9c843f9bff
SSDEEP:	1536:qxJz9igCn5FOygRJREoXKdvKarKM5aUmreQ5LwN9KjpHO0LvJ8:qxl05FOLRJRES1ar/5a5LlDJ8
TLSH:	0AA33991FC929652C2C526B7FA6E41CD376B13B8E3EA7203CE169B20778685B0D37445
File Content Preview:	.ELF...a..........(.........4...........4. ...(.....................@...@...............D...D...D.......Xj..........Q.td..................................-...L."...<]..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	104348
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x17528	0x0	0x6	AX	16
.fini	PROGBITS	0x1f5d8	0x175d8	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x1f5ec	0x175ec	0x1c54	0x0	0x2	A	4
.ctors	PROGBITS	0x29244	0x19244	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x2924c	0x1924c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x29258	0x19258	0x504	0x0	0x3	WA	4
.bss	NOBITS	0x2975c	0x1975c	0x6540	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x1975c	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x19240	0x19240	6.1861	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x19244	0x29244	0x29244	0x518	0x6a58	4.5502	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 420
• 38242 undefined
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 4, 2025 12:15:04.604692936 CET	44056	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:04.609735966 CET	38242	44056	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:04.609800100 CET	44056	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:04.610676050 CET	44056	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:04.615664005 CET	38242	44056	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:05.131324053 CET	44056	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:05.183914900 CET	38242	44056	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:06.138219118 CET	44058	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:06.143713951 CET	38242	44058	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:06.143804073 CET	44058	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:06.143804073 CET	44058	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:06.152081013 CET	38242	44058	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:06.288525105 CET	55768	53	192.168.2.15	8.8.8.8
Mar 4, 2025 12:15:06.293637037 CET	53	55768	8.8.8.8	192.168.2.15
Mar 4, 2025 12:15:06.293708086 CET	55768	53	192.168.2.15	8.8.8.8
Mar 4, 2025 12:15:06.293708086 CET	55768	53	192.168.2.15	8.8.8.8
Mar 4, 2025 12:15:06.293752909 CET	55768	53	192.168.2.15	8.8.8.8
Mar 4, 2025 12:15:06.298789978 CET	53	55768	8.8.8.8	192.168.2.15
Mar 4, 2025 12:15:06.298811913 CET	53	55768	8.8.8.8	192.168.2.15
Mar 4, 2025 12:15:06.714319944 CET	44058	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:06.740514040 CET	53	55768	8.8.8.8	192.168.2.15
Mar 4, 2025 12:15:06.740583897 CET	55768	53	192.168.2.15	8.8.8.8
Mar 4, 2025 12:15:06.759926081 CET	38242	44058	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:07.717652082 CET	44062	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:07.722840071 CET	38242	44062	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:07.722893000 CET	44062	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:07.722944021 CET	44062	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:07.728526115 CET	38242	44062	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:08.214289904 CET	38242	44056	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:08.214370012 CET	44056	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:08.240458965 CET	44062	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:08.287936926 CET	38242	44062	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:08.740250111 CET	53	55768	8.8.8.8	192.168.2.15
Mar 4, 2025 12:15:08.740371943 CET	55768	53	192.168.2.15	8.8.8.8
Mar 4, 2025 12:15:08.745390892 CET	53	55768	8.8.8.8	192.168.2.15
Mar 4, 2025 12:15:09.247936964 CET	44064	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:09.253060102 CET	38242	44064	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:09.253173113 CET	44064	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:09.253174067 CET	44064	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:09.258677959 CET	38242	44064	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:09.744231939 CET	38242	44058	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:09.744438887 CET	44058	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:09.762140036 CET	44064	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:09.807909012 CET	38242	44064	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:09.851322889 CET	38242	44064	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:09.851386070 CET	44064	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:10.764810085 CET	44066	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:10.769884109 CET	38242	44066	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:10.771929979 CET	44066	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:10.771955013 CET	44066	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:10.776973009 CET	38242	44066	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:11.278657913 CET	44066	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:11.323924065 CET	38242	44066	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:11.331789970 CET	38242	44062	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:11.331849098 CET	44062	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:11.367400885 CET	38242	44066	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:11.367455959 CET	44066	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:12.280534029 CET	44068	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:12.285743952 CET	38242	44068	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:12.285850048 CET	44068	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:12.285878897 CET	44068	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:12.290957928 CET	38242	44068	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:12.796488047 CET	44068	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:12.844748974 CET	38242	44068	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:12.886534929 CET	38242	44068	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:12.886636972 CET	44068	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:13.798779011 CET	44070	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:13.803857088 CET	38242	44070	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:13.803967953 CET	44070	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:13.803967953 CET	44070	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:13.809027910 CET	38242	44070	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:14.310187101 CET	44070	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:14.355910063 CET	38242	44070	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:15.311796904 CET	44072	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:15.316967964 CET	38242	44072	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:15.317018032 CET	44072	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:15.317040920 CET	44072	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:15.322110891 CET	38242	44072	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:15.824048042 CET	44072	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:15.871977091 CET	38242	44072	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:15.928381920 CET	38242	44072	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:15.928447962 CET	44072	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:16.825660944 CET	44074	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:16.830888033 CET	38242	44074	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:16.830944061 CET	44074	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:16.830982924 CET	44074	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:16.836024046 CET	38242	44074	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:17.335424900 CET	44074	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:17.384083986 CET	38242	44074	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:17.425199986 CET	38242	44074	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:17.425282955 CET	44074	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:18.336822033 CET	44076	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:18.342005014 CET	38242	44076	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:18.342087984 CET	44076	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:18.342122078 CET	44076	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:18.347142935 CET	38242	44076	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:18.847218990 CET	44076	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:18.895966053 CET	38242	44076	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:18.965704918 CET	38242	44076	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:18.965789080 CET	44076	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:19.848522902 CET	44078	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:19.853672981 CET	38242	44078	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:19.853764057 CET	44078	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:19.853787899 CET	44078	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:19.858767986 CET	38242	44078	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:20.357217073 CET	44078	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:20.403901100 CET	38242	44078	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:21.358469963 CET	44080	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:21.364245892 CET	38242	44080	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:21.364331961 CET	44080	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:21.364403963 CET	44080	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:21.369369030 CET	38242	44080	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:21.868413925 CET	44080	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:21.920861006 CET	38242	44080	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:22.869394064 CET	44082	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:22.876365900 CET	38242	44082	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:22.876424074 CET	44082	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:22.876446962 CET	44082	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:22.882128954 CET	38242	44082	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:23.380393982 CET	44082	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:23.427927017 CET	38242	44082	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:24.381326914 CET	44084	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:24.386451006 CET	38242	44084	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:24.386564970 CET	44084	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:24.386610031 CET	44084	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:24.391638994 CET	38242	44084	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:24.890454054 CET	44084	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:24.939935923 CET	38242	44084	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:24.988603115 CET	38242	44084	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:24.988715887 CET	44084	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:25.891580105 CET	44086	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:25.896770000 CET	38242	44086	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:25.896846056 CET	44086	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:25.896876097 CET	44086	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:25.901954889 CET	38242	44086	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:26.401523113 CET	44086	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:26.447921038 CET	38242	44086	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:26.495022058 CET	38242	44086	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:26.495193005 CET	44086	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:27.403405905 CET	44088	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:27.436067104 CET	38242	44088	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:27.436203003 CET	44088	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:27.436245918 CET	44088	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:27.441376925 CET	38242	44088	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:27.942675114 CET	44088	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:27.996028900 CET	38242	44088	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:28.041696072 CET	38242	44088	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:28.041781902 CET	44088	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:28.943716049 CET	44090	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:28.949775934 CET	38242	44090	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:28.949837923 CET	44090	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:28.949870110 CET	44090	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:28.955847979 CET	38242	44090	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:29.453696966 CET	44090	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:29.489662886 CET	38242	44078	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:29.489794016 CET	44078	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:29.511945963 CET	38242	44090	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:29.546186924 CET	38242	44090	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:29.546260118 CET	44090	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:30.454988956 CET	44092	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:30.460788965 CET	38242	44092	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:30.460891962 CET	44092	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:30.460954905 CET	44092	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:30.466067076 CET	38242	44092	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:30.964307070 CET	44092	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:30.966388941 CET	38242	44080	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:30.966454029 CET	44080	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:31.011921883 CET	38242	44092	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:31.059937000 CET	38242	44092	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:31.060046911 CET	44092	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:31.965267897 CET	44094	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:31.970560074 CET	38242	44094	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:31.970688105 CET	44094	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:31.970689058 CET	44094	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:31.975745916 CET	38242	44094	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:32.475302935 CET	44094	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:32.486788988 CET	38242	44082	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:32.486855984 CET	44082	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:32.527944088 CET	38242	44094	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:32.585781097 CET	38242	44094	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:32.585943937 CET	44094	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:33.477049112 CET	44096	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:33.482935905 CET	38242	44096	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:33.483047009 CET	44096	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:33.483120918 CET	44096	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:33.488214970 CET	38242	44096	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:33.988558054 CET	44096	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:34.036012888 CET	38242	44096	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:34.093575001 CET	38242	44096	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:34.093645096 CET	44096	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:34.989830971 CET	44098	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:34.995080948 CET	38242	44098	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:34.995161057 CET	44098	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:34.995186090 CET	44098	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:35.000267029 CET	38242	44098	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:35.197518110 CET	38242	44070	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:35.197645903 CET	44070	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:35.499489069 CET	44098	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:35.551985025 CET	38242	44098	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:35.598917007 CET	38242	44098	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:35.599005938 CET	44098	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:36.500631094 CET	44100	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:36.512449026 CET	38242	44100	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:36.512572050 CET	44100	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:36.512624025 CET	44100	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:36.524277925 CET	38242	44100	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:37.017330885 CET	44100	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:37.068006039 CET	38242	44100	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:37.133285046 CET	38242	44100	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:37.133451939 CET	44100	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:38.019123077 CET	44102	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:38.024288893 CET	38242	44102	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:38.024373055 CET	44102	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:38.024437904 CET	44102	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:38.029406071 CET	38242	44102	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:38.530808926 CET	44102	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:38.580063105 CET	38242	44102	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:38.629807949 CET	38242	44102	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:38.629915953 CET	44102	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:39.531874895 CET	44104	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:39.537298918 CET	38242	44104	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:39.537364006 CET	44104	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:39.537381887 CET	44104	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:39.542491913 CET	38242	44104	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:40.040889025 CET	44104	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:40.088062048 CET	38242	44104	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:41.041878939 CET	44106	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:41.047029018 CET	38242	44106	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:41.047110081 CET	44106	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:41.047137022 CET	44106	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:41.052264929 CET	38242	44106	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:41.551261902 CET	44106	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:41.600081921 CET	38242	44106	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:41.656399965 CET	38242	44106	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:41.656495094 CET	44106	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:42.552249908 CET	44108	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:42.557430029 CET	38242	44108	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:42.557764053 CET	44108	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:42.557795048 CET	44108	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:42.562907934 CET	38242	44108	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:43.062026024 CET	44108	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:43.108031034 CET	38242	44108	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:44.063452005 CET	44110	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:44.068602085 CET	38242	44110	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:44.068773985 CET	44110	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:44.068774939 CET	44110	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:44.073826075 CET	38242	44110	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:44.573024035 CET	44110	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:44.624082088 CET	38242	44110	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:44.666601896 CET	38242	44110	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:44.666745901 CET	44110	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:45.574496031 CET	44112	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:45.580159903 CET	38242	44112	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:45.580224991 CET	44112	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:45.580267906 CET	44112	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:45.585330009 CET	38242	44112	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:46.084491968 CET	44112	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:46.136106014 CET	38242	44112	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:46.173202991 CET	38242	44112	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:46.173324108 CET	44112	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:47.085556030 CET	44114	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:47.090715885 CET	38242	44114	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:47.090774059 CET	44114	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:47.090801954 CET	44114	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:47.095778942 CET	38242	44114	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:47.594803095 CET	44114	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:47.640243053 CET	38242	44114	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:48.596148014 CET	44116	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:48.601361990 CET	38242	44116	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:48.601624966 CET	44116	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:48.601660013 CET	44116	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:48.606678009 CET	38242	44116	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:49.105314970 CET	44116	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:49.154035091 CET	38242	44116	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:49.198137999 CET	38242	44116	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:49.198276043 CET	44116	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:50.106251001 CET	44118	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:50.111382008 CET	38242	44118	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:50.111491919 CET	44118	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:50.111512899 CET	44118	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:50.117569923 CET	38242	44118	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:50.616286993 CET	44118	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:50.664103985 CET	38242	44118	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:50.709350109 CET	38242	44118	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:50.709450960 CET	44118	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:51.617432117 CET	44120	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:51.622752905 CET	38242	44120	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:51.622864008 CET	44120	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:51.622978926 CET	44120	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:51.628084898 CET	38242	44120	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:52.126935959 CET	44120	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:52.172116995 CET	38242	44120	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:52.251935959 CET	38242	44120	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:52.252027035 CET	44120	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:53.128051043 CET	44122	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:53.133794069 CET	38242	44122	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:53.133884907 CET	44122	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:53.133927107 CET	44122	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:53.139430046 CET	38242	44122	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:53.638642073 CET	44122	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:53.684247971 CET	38242	44122	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:53.734560966 CET	38242	44122	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:53.734630108 CET	44122	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:54.640430927 CET	44124	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:54.645802975 CET	38242	44124	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:54.645914078 CET	44124	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:54.645967007 CET	44124	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:54.651027918 CET	38242	44124	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:55.151827097 CET	44124	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:55.200562954 CET	38242	44124	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:55.242255926 CET	38242	44124	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:55.242399931 CET	44124	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:56.152899027 CET	44126	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:56.158303022 CET	38242	44126	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:56.158462048 CET	44126	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:56.158462048 CET	44126	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:56.163672924 CET	38242	44126	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:56.662275076 CET	44126	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:56.691823959 CET	38242	44114	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:56.691905975 CET	44114	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:56.712213039 CET	38242	44126	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:56.755484104 CET	38242	44126	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:56.755589008 CET	44126	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:57.663331032 CET	44128	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:57.668601990 CET	38242	44128	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:57.668771029 CET	44128	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:57.668771029 CET	44128	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:57.674187899 CET	38242	44128	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:58.173331976 CET	44128	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:58.224229097 CET	38242	44128	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:58.270597935 CET	38242	44128	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:58.270762920 CET	44128	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:59.174699068 CET	44130	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:59.180275917 CET	38242	44130	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:59.180377960 CET	44130	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:59.180398941 CET	44130	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:59.186223030 CET	38242	44130	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:59.685530901 CET	44130	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:15:59.732245922 CET	38242	44130	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:59.795841932 CET	38242	44130	176.65.134.15	192.168.2.15
Mar 4, 2025 12:15:59.795948029 CET	44130	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:00.687064886 CET	44132	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:00.692434072 CET	38242	44132	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:00.692543030 CET	44132	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:00.692581892 CET	44132	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:00.697716951 CET	38242	44132	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:00.934132099 CET	38242	44104	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:00.934252977 CET	44104	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:01.196443081 CET	44132	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:01.244167089 CET	38242	44132	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:01.297137976 CET	38242	44132	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:01.297344923 CET	44132	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:02.197968006 CET	44134	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:02.203223944 CET	38242	44134	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:02.203325033 CET	44134	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:02.203376055 CET	44134	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:02.208524942 CET	38242	44134	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:02.709705114 CET	44134	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:02.756258965 CET	38242	44134	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:02.816885948 CET	38242	44134	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:02.816971064 CET	44134	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:03.711393118 CET	44136	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:03.716865063 CET	38242	44136	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:03.717060089 CET	44136	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:03.717060089 CET	44136	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:03.723712921 CET	38242	44136	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:03.950572968 CET	38242	44108	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:03.950717926 CET	44108	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:04.222601891 CET	44136	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:04.272336960 CET	38242	44136	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:05.224203110 CET	44138	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:05.229579926 CET	38242	44138	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:05.229759932 CET	44138	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:05.229759932 CET	44138	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:05.234869003 CET	38242	44138	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:05.735775948 CET	44138	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:05.797015905 CET	38242	44138	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:05.833962917 CET	38242	44138	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:05.834172964 CET	44138	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:06.737684965 CET	44140	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:06.743019104 CET	38242	44140	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:06.743096113 CET	44140	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:06.743135929 CET	44140	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:06.748212099 CET	38242	44140	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:07.249592066 CET	44140	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:07.296278954 CET	38242	44140	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:07.365473032 CET	38242	44140	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:07.365612030 CET	44140	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:08.251008987 CET	44142	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:08.256370068 CET	38242	44142	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:08.256454945 CET	44142	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:08.256490946 CET	44142	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:08.261538982 CET	38242	44142	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:08.761567116 CET	44142	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:08.808310986 CET	38242	44142	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:09.763588905 CET	44144	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:09.768713951 CET	38242	44144	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:09.768842936 CET	44144	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:09.768898964 CET	44144	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:09.773921967 CET	38242	44144	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:10.275895119 CET	44144	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:10.324270010 CET	38242	44144	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:11.277944088 CET	44146	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:11.283035040 CET	38242	44146	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:11.283134937 CET	44146	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:11.283308983 CET	44146	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:11.288404942 CET	38242	44146	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:11.788511992 CET	44146	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:11.836335897 CET	38242	44146	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:11.856120110 CET	38242	44142	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:11.856242895 CET	44142	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:12.790604115 CET	44148	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:12.795804024 CET	38242	44148	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:12.795896053 CET	44148	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:12.795934916 CET	44148	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:12.801048994 CET	38242	44148	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:13.303625107 CET	44148	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:13.356452942 CET	38242	44148	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:13.375386953 CET	38242	44144	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:13.375534058 CET	44144	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:13.415726900 CET	38242	44148	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:13.415930033 CET	44148	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:14.305773973 CET	44150	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:14.310986996 CET	38242	44150	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:14.311120987 CET	44150	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:14.311120987 CET	44150	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:14.316179037 CET	38242	44150	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:14.816463947 CET	44150	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:14.864330053 CET	38242	44150	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:14.899487019 CET	38242	44146	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:14.899698019 CET	44146	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:14.925497055 CET	38242	44150	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:14.925774097 CET	44150	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:15.818065882 CET	44152	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:15.823417902 CET	38242	44152	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:15.823682070 CET	44152	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:15.823738098 CET	44152	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:15.828896999 CET	38242	44152	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:16.329586029 CET	44152	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:16.376271009 CET	38242	44152	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:17.331629992 CET	44154	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:17.336956024 CET	38242	44154	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:17.337074995 CET	44154	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:17.337138891 CET	44154	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:17.342206001 CET	38242	44154	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:17.443630934 CET	38242	44152	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:17.443737030 CET	44152	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:17.843888044 CET	44154	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:17.892436981 CET	38242	44154	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:17.967474937 CET	38242	44154	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:17.967674017 CET	44154	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:18.845777988 CET	44156	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:18.850965977 CET	38242	44156	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:18.851048946 CET	44156	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:18.851110935 CET	44156	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:18.856122017 CET	38242	44156	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:19.357156992 CET	44156	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:19.404397964 CET	38242	44156	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:19.456031084 CET	38242	44156	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:19.456161976 CET	44156	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:20.358889103 CET	44158	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:20.364506006 CET	38242	44158	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:20.364599943 CET	44158	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:20.364667892 CET	44158	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:20.370182037 CET	38242	44158	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:20.870508909 CET	44158	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:20.916337967 CET	38242	44158	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:20.986980915 CET	38242	44158	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:20.987138987 CET	44158	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:21.872380972 CET	44160	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:21.877595901 CET	38242	44160	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:21.877665997 CET	44160	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:21.877734900 CET	44160	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:21.882739067 CET	38242	44160	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:22.383965969 CET	44160	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:22.432373047 CET	38242	44160	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:22.497750044 CET	38242	44160	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:22.497899055 CET	44160	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:23.385910034 CET	44162	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:23.391177893 CET	38242	44162	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:23.391248941 CET	44162	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:23.391282082 CET	44162	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:23.396409035 CET	38242	44162	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:23.898041010 CET	44162	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:23.948389053 CET	38242	44162	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:24.000469923 CET	38242	44162	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:24.000597000 CET	44162	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:24.899818897 CET	44164	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:24.905127048 CET	38242	44164	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:24.905185938 CET	44164	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:24.905215979 CET	44164	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:24.910269976 CET	38242	44164	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:25.104752064 CET	38242	44136	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:25.105010986 CET	44136	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:25.413343906 CET	44164	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:25.460366964 CET	38242	44164	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:25.525314093 CET	38242	44164	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:25.525620937 CET	44164	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:26.415112019 CET	44166	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:26.420434952 CET	38242	44166	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:26.420506001 CET	44166	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:26.420537949 CET	44166	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:26.425601959 CET	38242	44166	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:26.926376104 CET	44166	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:26.980355024 CET	38242	44166	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:27.030522108 CET	38242	44166	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:27.030708075 CET	44166	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:27.928352118 CET	44168	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:27.933718920 CET	38242	44168	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:27.933845043 CET	44168	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:27.933900118 CET	44168	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:27.938982010 CET	38242	44168	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:28.441076040 CET	44168	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:28.488378048 CET	38242	44168	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:29.442708969 CET	44170	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:29.447899103 CET	38242	44170	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:29.448030949 CET	44170	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:29.448214054 CET	44170	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:29.453239918 CET	38242	44170	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:29.569957972 CET	38242	44168	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:29.570060015 CET	44168	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:29.954129934 CET	44170	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:30.000464916 CET	38242	44170	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:30.047720909 CET	38242	44170	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:30.047864914 CET	44170	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:30.956032038 CET	44172	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:30.961760044 CET	38242	44172	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:30.961843967 CET	44172	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:30.961905003 CET	44172	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:30.966960907 CET	38242	44172	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:31.468425035 CET	44172	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:31.516408920 CET	38242	44172	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:32.470072031 CET	44174	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:32.475241899 CET	38242	44174	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:32.475369930 CET	44174	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:32.475433111 CET	44174	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:32.480464935 CET	38242	44174	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:32.982336044 CET	44174	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:33.028552055 CET	38242	44174	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:33.093544006 CET	38242	44174	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:33.093705893 CET	44174	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:33.984468937 CET	44176	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:33.989629984 CET	38242	44176	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:33.989772081 CET	44176	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:33.989892960 CET	44176	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:33.994926929 CET	38242	44176	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:34.497718096 CET	44176	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:34.544478893 CET	38242	44176	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:34.587923050 CET	38242	44176	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:34.588088989 CET	44176	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:35.499530077 CET	44178	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:35.504730940 CET	38242	44178	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:35.504834890 CET	44178	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:35.504864931 CET	44178	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:35.509922028 CET	38242	44178	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:36.011643887 CET	44178	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:36.060419083 CET	38242	44178	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:36.117398024 CET	38242	44178	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:36.117628098 CET	44178	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:37.013489008 CET	44180	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:37.018785000 CET	38242	44180	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:37.018877029 CET	44180	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:37.018918037 CET	44180	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:37.024068117 CET	38242	44180	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:37.525391102 CET	44180	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:37.578299999 CET	38242	44180	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:37.631855965 CET	38242	44180	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:37.632024050 CET	44180	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:38.527441025 CET	44182	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:38.532516003 CET	38242	44182	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:38.532613993 CET	44182	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:38.532666922 CET	44182	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:38.537626028 CET	38242	44182	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:39.039797068 CET	44182	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:39.088499069 CET	38242	44182	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:39.144838095 CET	38242	44182	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:39.145128012 CET	44182	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:40.041676044 CET	44184	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:40.046890974 CET	38242	44184	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:40.047039986 CET	44184	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:40.047089100 CET	44184	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:40.052144051 CET	38242	44184	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:40.553579092 CET	44184	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:40.563930035 CET	38242	44172	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:40.564049006 CET	44172	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:40.600462914 CET	38242	44184	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:40.668391943 CET	38242	44184	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:40.668546915 CET	44184	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:41.555607080 CET	44186	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:41.560802937 CET	38242	44186	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:41.560957909 CET	44186	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:41.561003923 CET	44186	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:41.566057920 CET	38242	44186	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:42.067362070 CET	44186	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:42.118355989 CET	38242	44186	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:43.070034981 CET	44188	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:43.077461004 CET	38242	44188	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:43.077559948 CET	44188	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:43.077613115 CET	44188	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:43.082647085 CET	38242	44188	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:43.584193945 CET	44188	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:43.632525921 CET	38242	44188	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:43.672324896 CET	38242	44188	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:43.672439098 CET	44188	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:44.586148977 CET	44190	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:44.591481924 CET	38242	44190	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:44.591578007 CET	44190	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:44.591620922 CET	44190	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:44.596692085 CET	38242	44190	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:45.099195004 CET	44190	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:45.148560047 CET	38242	44190	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:45.212030888 CET	38242	44190	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:45.212189913 CET	44190	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:46.100785971 CET	44192	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:46.106009960 CET	38242	44192	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:46.106096029 CET	44192	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:46.106159925 CET	44192	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:46.111226082 CET	38242	44192	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:46.614012957 CET	44192	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:46.664561987 CET	38242	44192	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:46.718715906 CET	38242	44192	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:46.718868017 CET	44192	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:47.616101027 CET	44194	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:47.621486902 CET	38242	44194	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:47.621581078 CET	44194	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:47.621632099 CET	44194	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:47.626667023 CET	38242	44194	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:48.129741907 CET	44194	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:48.176583052 CET	38242	44194	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:48.228600979 CET	38242	44194	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:48.228765965 CET	44194	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:49.132283926 CET	44196	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:49.137434959 CET	38242	44196	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:49.137602091 CET	44196	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:49.137629986 CET	44196	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:49.144726038 CET	38242	44196	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:49.643603086 CET	44196	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:49.692562103 CET	38242	44196	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:49.734225035 CET	38242	44196	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:49.734381914 CET	44196	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:50.645358086 CET	44198	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:50.650546074 CET	38242	44198	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:50.650691986 CET	44198	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:50.650753021 CET	44198	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:50.655762911 CET	38242	44198	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:51.156125069 CET	44198	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:51.177201986 CET	38242	44186	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:51.177401066 CET	44186	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:51.204468966 CET	38242	44198	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:52.157356024 CET	44200	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:52.162595987 CET	38242	44200	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:52.162668943 CET	44200	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:52.162719011 CET	44200	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:52.167850018 CET	38242	44200	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:52.668464899 CET	44200	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:52.716531038 CET	38242	44200	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:52.768516064 CET	38242	44200	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:52.768625021 CET	44200	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:53.670485973 CET	44202	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:53.675774097 CET	38242	44202	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:53.675868988 CET	44202	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:53.675940990 CET	44202	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:53.681030035 CET	38242	44202	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:54.183964968 CET	44202	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:54.232553005 CET	38242	44202	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:54.271871090 CET	38242	44202	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:54.271990061 CET	44202	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:55.186599970 CET	44204	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:55.191849947 CET	38242	44204	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:55.192003012 CET	44204	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:55.192039967 CET	44204	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:55.197097063 CET	38242	44204	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:55.700042009 CET	44204	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:55.748661041 CET	38242	44204	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:55.790616035 CET	38242	44204	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:55.790719032 CET	44204	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:56.702516079 CET	44206	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:56.707798958 CET	38242	44206	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:56.707911968 CET	44206	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:56.707952023 CET	44206	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:56.713048935 CET	38242	44206	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:57.216094971 CET	44206	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:57.270215034 CET	38242	44206	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:57.323959112 CET	38242	44206	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:57.324181080 CET	44206	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:58.218346119 CET	44208	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:58.223618031 CET	38242	44208	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:58.223742008 CET	44208	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:58.223795891 CET	44208	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:58.228864908 CET	38242	44208	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:58.731339931 CET	44208	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:58.776572943 CET	38242	44208	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:58.845041990 CET	38242	44208	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:58.845168114 CET	44208	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:59.732897043 CET	44210	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:59.739691019 CET	38242	44210	176.65.134.15	192.168.2.15
Mar 4, 2025 12:16:59.739747047 CET	44210	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:59.739770889 CET	44210	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:16:59.745069981 CET	38242	44210	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:00.246882915 CET	44210	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:00.262110949 CET	38242	44198	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:00.262240887 CET	44198	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:00.296607971 CET	38242	44210	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:00.361382008 CET	38242	44210	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:00.361517906 CET	44210	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:01.248812914 CET	44212	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:01.255021095 CET	38242	44212	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:01.255188942 CET	44212	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:01.255188942 CET	44212	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:01.261079073 CET	38242	44212	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:01.763988018 CET	44212	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:01.812725067 CET	38242	44212	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:02.766421080 CET	44214	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:02.771734953 CET	38242	44214	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:02.771847963 CET	44214	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:02.771915913 CET	44214	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:02.776884079 CET	38242	44214	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:03.280616045 CET	44214	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:03.328769922 CET	38242	44214	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:03.371088028 CET	38242	44214	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:03.371349096 CET	44214	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:04.283432961 CET	44216	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:04.288542986 CET	38242	44216	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:04.288595915 CET	44216	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:04.288631916 CET	44216	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:04.293628931 CET	38242	44216	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:04.794759989 CET	44216	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:04.844602108 CET	38242	44216	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:04.896945953 CET	38242	44216	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:04.897095919 CET	44216	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:05.797272921 CET	44218	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:05.802638054 CET	38242	44218	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:05.802736044 CET	44218	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:05.802802086 CET	44218	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:05.807882071 CET	38242	44218	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:06.311078072 CET	44218	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:06.360677004 CET	38242	44218	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:06.397047043 CET	38242	44218	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:06.397142887 CET	44218	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:07.312733889 CET	44220	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:07.317851067 CET	38242	44220	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:07.317962885 CET	44220	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:07.318008900 CET	44220	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:07.323016882 CET	38242	44220	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:07.823355913 CET	44220	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:07.872857094 CET	38242	44220	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:07.932154894 CET	38242	44220	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:07.932445049 CET	44220	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:08.825679064 CET	44222	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:08.831032038 CET	38242	44222	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:08.831175089 CET	44222	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:08.831211090 CET	44222	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:08.836337090 CET	38242	44222	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:09.338370085 CET	44222	38242	192.168.2.15	176.65.134.15
Mar 4, 2025 12:17:09.388688087 CET	38242	44222	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:09.441015005 CET	38242	44222	176.65.134.15	192.168.2.15
Mar 4, 2025 12:17:09.441175938 CET	44222	38242	192.168.2.15	176.65.134.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 4, 2025 12:15:06.293708086 CET	192.168.2.15	8.8.8.8	0xc299	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Mar 4, 2025 12:15:06.293752909 CET	192.168.2.15	8.8.8.8	0x9729	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

System Behavior

Analysis Process: arm.nn.elf PID: 5814, Parent PID: 5738

General

Start time (UTC):	11:15:03
Start date (UTC):	04/03/2025
Path:	/tmp/arm.nn.elf
Arguments:	/tmp/arm.nn.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

File Deleted

File Read

File Written

Directory Enumerated

Symbolic Link Created

Process Activities

Process Forked

Signal Sent

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Listening

Socket Connecting

Chronological Activities

Analysis Process: arm.nn.elf PID: 5836, Parent PID: 5814

General

Start time (UTC):	11:15:03
Start date (UTC):	04/03/2025
Path:	/tmp/arm.nn.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: arm.nn.elf PID: 5838, Parent PID: 5836

General

Start time (UTC):	11:15:03
Start date (UTC):	04/03/2025
Path:	/tmp/arm.nn.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Prctl Requested

Thread Sleep

Chronological Activities

Analysis Process: udisksd PID: 5825, Parent PID: 803

General

Start time (UTC):	11:15:03
Start date (UTC):	04/03/2025
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: dumpe2fs PID: 5825, Parent PID: 803

General

Start time (UTC):	11:15:03
Start date (UTC):	04/03/2025
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

File Activities

File Opened

File Read

Process Activities

Prctl Requested

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: udisksd PID: 5884, Parent PID: 803

General

Start time (UTC):	11:15:04
Start date (UTC):	04/03/2025
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: dumpe2fs PID: 5884, Parent PID: 803

General

Start time (UTC):	11:15:04
Start date (UTC):	04/03/2025
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report arm.nn.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/etc/motd

/tmp/qemu-open.CmLUDR (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

DNS Queries

System Behavior

Analysis Process: arm.nn.elf PID: 5814, Parent PID: 5738

General

File Activities

File Opened

File Deleted

File Read

File Written

Directory Enumerated

Symbolic Link Created

Process Activities

Process Forked

Signal Sent

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Listening

Socket Connecting

Linux Analysis Report
arm.nn.elf