Edit tour

Linux Analysis Report
mips.nn.elf

Overview

General Information

Sample name:	mips.nn.elf
Analysis ID:	1629572
MD5:	dc2a199dc13a7a9853166e9658d7ac6d
SHA1:	9f4d23275896eb1be72478700b5d072bfb32b528
SHA256:	0c05746b64bc820f026ab8c7ecfb556f207657ecddc60d3f3b8f071cc16a70f9
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	64
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Mirai

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample has stripped symbol table

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1629572
Start date and time:	2025-03-04 21:47:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	mips.nn.elf
Detection:	MAL
Classification:	mal64.troj.linELF@0/2@0/0

Runtime Messages

Command:	/tmp/mips.nn.elf
PID:	6242
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	The Gorilla Botnet Cats Came After You!
Standard Error:

Process Tree

system is lnxubuntu20

mips.nn.elf (PID: 6242, Parent: 6159, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/mips.nn.elf

mips.nn.elf New Fork (PID: 6264, Parent: 6242)

mips.nn.elf New Fork (PID: 6266, Parent: 6264)

udisksd New Fork (PID: 6252, Parent: 799)

dumpe2fs (PID: 6252, Parent: 799, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

udisksd New Fork (PID: 6288, Parent: 799)

dumpe2fs (PID: 6288, Parent: 799, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
mips.nn.elf	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6242.1.00007ff80c400000.00007ff80c41f000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Persistence and Installation Behavior
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: mips.nn.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: mips.nn.elf

ReversingLabs: Detection: 47%

Source: global traffic

TCP traffic: 192.168.2.23:58492 -> 176.65.134.15:38242

Source: /tmp/mips.nn.elf (PID: 6242)

Socket: 127.0.0.1:38242

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.15

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal64.troj.linELF@0/2@0/0

Source: /tmp/mips.nn.elf (PID: 6266)	File opened: /proc/6331/status	Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6266)	File opened: /proc/6330/status	Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6266)	File opened: /proc/6300/status	Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6266)	File opened: /proc/6322/status	Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6266)	File opened: /proc/6333/status	Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6266)	File opened: /proc/6288/status	Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6266)	File opened: /proc/6332/status	Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6266)	File opened: /proc/6324/status	Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6266)	File opened: /proc/6335/status	Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6266)	File opened: /proc/6323/status	Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6266)	File opened: /proc/6334/status	Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6266)	File opened: /proc/6071/cmdline	Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6266)	File opened: /proc/799/cmdline	Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6266)	File opened: /proc/6326/status	Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6266)	File opened: /proc/6325/status	Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6266)	File opened: /proc/6336/status	Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6266)	File opened: /proc/6328/status	Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6266)	File opened: /proc/6327/status	Jump to behavior
Source: /tmp/mips.nn.elf (PID: 6266)	File opened: /proc/6329/status	Jump to behavior

Source: /tmp/mips.nn.elf (PID: 6242)

Queries kernel information via 'uname':

Jump to behavior

Source: mips.nn.elf, 6242.1.000056367463d000.00005636746e4000.rw-.sdmp	Binary or memory string: \|lt6Vu-binfmt/mips/usr/bin/vmtoolsd
Source: mips.nn.elf, 6242.1.000056367463d000.00005636746e4000.rw-.sdmp	Binary or memory string: 'et6V et6V!/etc/qemu-binfmt/mips
Source: mips.nn.elf, 6242.1.000056367463d000.00005636746e4000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: mips.nn.elf, 6242.1.000056367463d000.00005636746e4000.rw-.sdmp	Binary or memory string: /usr/bin/vmtoolsd
Source: mips.nn.elf, 6242.1.00007ffd8bf34000.00007ffd8bf55000.rw-.sdmp	Binary or memory string: %s/qemu-op
Source: mips.nn.elf, 6242.1.00007ffd8bf34000.00007ffd8bf55000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips
Source: mips.nn.elf, 6242.1.00007ffd8bf34000.00007ffd8bf55000.rw-.sdmp	Binary or memory string: Psx86_64/usr/bin/qemu-mips/tmp/mips.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mips.nn.elf
Source: mips.nn.elf, 6242.1.000056367463d000.00005636746e4000.rw-.sdmp	Binary or memory string: ft6VCertificate!/usr/bin/vmtoolsd
Source: mips.nn.elf, 6242.1.00007ffd8bf34000.00007ffd8bf55000.rw-.sdmp	Binary or memory string: MPDIR%s/qemu-op
Source: mips.nn.elf, 6242.1.000056367463d000.00005636746e4000.rw-.sdmp	Binary or memory string: u-binfmt/mips/usr/bin/vmtoolsd
Source: mips.nn.elf, 6242.1.00007ffd8bf34000.00007ffd8bf55000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.m5VCha
Source: mips.nn.elf, 6242.1.00007ffd8bf34000.00007ffd8bf55000.rw-.sdmp	Binary or memory string: q6V/tmp/qemu-open.m5VCha\D

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: mips.nn.elf, type: SAMPLE
Source: Yara match	File source: 6242.1.00007ff80c400000.00007ff80c41f000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: mips.nn.elf, type: SAMPLE
Source: Yara match	File source: 6242.1.00007ff80c400000.00007ff80c41f000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
mips.nn.elf	47%	ReversingLabs	Linux.Backdoor.Mirai
mips.nn.elf	100%	Avira	EXP/ELF.Mirai.W

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
176.65.134.15	unknown	Germany	56325	DIOGELO-ASGB	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
176.65.134.15	arm5.nn.elf	Get hash	malicious	Mirai	Browse
	arm.nn.elf	Get hash	malicious	Mirai	Browse
	arm7.nn.elf	Get hash	malicious	Mirai	Browse
	sh4.nn.elf	Get hash	malicious	Mirai	Browse
	powerpc.nn.elf	Get hash	malicious	Mirai	Browse
	mipsel.nn.elf	Get hash	malicious	Mirai	Browse
	x86_32.nn.elf	Get hash	malicious	Mirai	Browse
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse
	sparc.nn.elf	Get hash	malicious	Mirai	Browse
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse
91.189.91.43	na.elf	Get hash	malicious	Prometei	Browse
	cbr.spc.elf	Get hash	malicious	Mirai	Browse
	vejfa5.elf	Get hash	malicious	Unknown	Browse
	donk.arm7.elf	Get hash	malicious	Mirai	Browse
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	cbr.spc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	vejfa5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	donk.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
DIOGELO-ASGB	arm5.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	arm.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	arm7.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	sh4.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	powerpc.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	mipsel.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	x86_32.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	sparc.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	x86_64.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
INIT7CH	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	cbr.spc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	vejfa5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	donk.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/etc/motd

Download File

Process:	/tmp/mips.nn.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	53
Entropy (8bit):	3.871459242626451
Encrypted:	false
SSDEEP:	3:yGKtARxFQFrgBJ4BJ+3e:dQ0EcHG2e
MD5:	2BD9B4BE30579E633FC0191AA93DF486
SHA1:	7D63A9BD9662E86666B27C1B50DB8E7370C624FF
SHA-256:	64DC39F3004DC93C9FC4F1467B4807F2D8E3EB0BFA96B15C19CD8E7D6FA77A1D
SHA-512:	AE6DD7B39191354CF43CF65E517460D7D4C61B8F5C08E33E6CA3C451DC7CAB4DE89F33934C89396B80F1AADE0A4E2571BD5AE8B76EF80B737D4588703D2814D5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	gorilla botnet is on the device ur not a cat go away.

/tmp/qemu-open.m5VCha (deleted)

Download File

Process:	/tmp/mips.nn.elf
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.4992275471326932
Encrypted:	false
SSDEEP:	3:TgaLOln:TgAKn
MD5:	3B2A108EB9BDAC564681D1D50B5B8E8F
SHA1:	E744F918D99769B49D0C6E8CBEDD4A1590CBBD1E
SHA-256:	B89FE9B42F66509FF52B529092B42F8D759FB8E03059E8CC4039940A45287D87
SHA-512:	52A5D2AB05D38B4EEE703B8344837CA7B890D6C8CC32C7AAEE8F128EBBE5F45A92A72A54E8A14B4DB61E9E7E002CED615B52E7503F50FB46AD8738921B1C98A5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	/tmp/mips.nn.elf.

Static File Info

General

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.6073567580792725
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	mips.nn.elf
File size:	129'708 bytes
MD5:	dc2a199dc13a7a9853166e9658d7ac6d
SHA1:	9f4d23275896eb1be72478700b5d072bfb32b528
SHA256:	0c05746b64bc820f026ab8c7ecfb556f207657ecddc60d3f3b8f071cc16a70f9
SHA512:	ff1af1c0489e1da4a21e014e6fe067cc938353d8877c099d638491b3781f003c60a6e115c6840bac535d5c7a1745cd77b89accd2be888d0f2afee988a93293ca
SSDEEP:	3072:XpUJ6wV46EdQF2mYPut4/HHH3hQt0Vzgbx9GRi:XqJ6wV46EdQF2mYmt4v3QmksRi
TLSH:	D7C3C70E6E218F6DF369873847B78E25A39833D627D1C685D26CD5105F6038D286FFA8
File Content Preview:	.ELF.....................@.`...4...\|.....4. ...(.............@...@...........................E...E........s$........dt.Q............................<...'.o....!'.......................<...'.o....!... ....'9... ......................<...'.o....!........'9.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	129148
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x1cb80	0x0	0x6	AX	16
.fini	PROGBITS	0x41cca0	0x1cca0	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x41cd00	0x1cd00	0x1d90	0x0	0x2	A	16
.ctors	PROGBITS	0x45ea94	0x1ea94	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x45ea9c	0x1ea9c	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x45eaa8	0x1eaa8	0x5c	0x0	0x3	WA	4
.data	PROGBITS	0x45eb10	0x1eb10	0x568	0x0	0x3	WA	16
.got	PROGBITS	0x45f080	0x1f080	0x798	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x45f818	0x1f818	0x28	0x0	0x10000003	WAp	4
.bss	NOBITS	0x45f840	0x1f818	0x6578	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0xea0	0x1f818	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x1f818	0x64	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x1ea90	0x1ea90	5.6216	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x1ea94	0x45ea94	0x45ea94	0xd84	0x7324	4.3050	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 422
• 38242 undefined
• 443 (HTTPS)
• 80 (HTTP)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 4, 2025 21:48:01.770158052 CET	43928	443	192.168.2.23	91.189.91.42
Mar 4, 2025 21:48:03.273756981 CET	58492	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:03.278768063 CET	38242	58492	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:03.278840065 CET	58492	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:03.287516117 CET	58492	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:03.292490005 CET	38242	58492	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:03.891036034 CET	58492	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:03.940025091 CET	38242	58492	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:04.893099070 CET	58494	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:04.898180962 CET	38242	58494	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:04.898242950 CET	58494	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:04.898257971 CET	58494	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:04.903261900 CET	38242	58494	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:05.403253078 CET	58494	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:05.452114105 CET	38242	58494	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:06.404808998 CET	58496	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:06.409959078 CET	38242	58496	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:06.410111904 CET	58496	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:06.410130024 CET	58496	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:06.415213108 CET	38242	58496	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:06.914526939 CET	58496	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:06.964107037 CET	38242	58496	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:07.145241022 CET	42836	443	192.168.2.23	91.189.91.43
Mar 4, 2025 21:48:07.926047087 CET	58498	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:07.931077957 CET	38242	58498	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:07.931130886 CET	58498	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:07.935055971 CET	58498	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:07.940084934 CET	38242	58498	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:08.169179916 CET	42516	80	192.168.2.23	109.202.202.202
Mar 4, 2025 21:48:08.474123955 CET	58498	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:08.508925915 CET	38242	58494	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:08.508990049 CET	58494	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:08.520030022 CET	38242	58498	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:09.476357937 CET	58500	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:09.481398106 CET	38242	58500	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:09.481455088 CET	58500	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:09.481473923 CET	58500	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:09.486459017 CET	38242	58500	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:10.061173916 CET	58500	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:10.061520100 CET	38242	58496	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:10.064371109 CET	58496	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:10.108390093 CET	38242	58500	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:11.074743032 CET	58502	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:11.079778910 CET	38242	58502	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:11.079844952 CET	58502	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:11.079858065 CET	58502	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:11.084929943 CET	38242	58502	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:11.550044060 CET	38242	58498	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:11.550107956 CET	58498	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:11.583746910 CET	58502	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:11.636089087 CET	38242	58502	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:11.713608027 CET	38242	58502	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:11.713692904 CET	58502	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:12.584645033 CET	58504	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:12.589715958 CET	38242	58504	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:12.589768887 CET	58504	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:12.589785099 CET	58504	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:12.594754934 CET	38242	58504	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:12.958024025 CET	38242	58492	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:12.958090067 CET	58492	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:13.093211889 CET	58504	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:13.144154072 CET	38242	58504	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:13.223088026 CET	38242	58504	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:13.223149061 CET	58504	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:14.094153881 CET	58506	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:14.099301100 CET	38242	58506	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:14.099360943 CET	58506	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:14.099389076 CET	58506	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:14.104389906 CET	38242	58506	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:14.603121042 CET	58506	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:14.652000904 CET	38242	58506	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:15.604022026 CET	58508	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:15.609020948 CET	38242	58508	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:15.609102011 CET	58508	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:15.609117031 CET	58508	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:15.614383936 CET	38242	58508	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:16.113426924 CET	58508	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:16.160063982 CET	38242	58508	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:16.206548929 CET	38242	58508	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:16.206635952 CET	58508	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:17.114599943 CET	58510	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:17.727166891 CET	38242	58510	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:17.727277040 CET	58510	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:17.727336884 CET	58510	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:17.738811970 CET	38242	58510	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:18.231950998 CET	58510	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:18.280127048 CET	38242	58510	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:18.359185934 CET	38242	58510	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:18.359251976 CET	58510	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:19.109019041 CET	38242	58500	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:19.109138966 CET	58500	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:19.233356953 CET	58512	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:19.238420963 CET	38242	58512	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:19.238487959 CET	58512	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:19.238537073 CET	58512	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:19.243562937 CET	38242	58512	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:19.742618084 CET	58512	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:19.792180061 CET	38242	58512	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:19.844528913 CET	38242	58512	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:19.844949961 CET	58512	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:20.743839979 CET	58514	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:20.749032021 CET	38242	58514	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:20.749119997 CET	58514	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:20.749159098 CET	58514	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:20.754147053 CET	38242	58514	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:21.253542900 CET	58514	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:21.300282955 CET	38242	58514	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:21.415015936 CET	38242	58514	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:21.415185928 CET	58514	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:22.254518032 CET	58516	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:22.503125906 CET	43928	443	192.168.2.23	91.189.91.42
Mar 4, 2025 21:48:22.582427979 CET	38242	58516	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:22.582490921 CET	58516	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:22.582542896 CET	58516	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:22.587825060 CET	38242	58516	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:23.088114977 CET	58516	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:23.176069975 CET	38242	58516	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:23.181127071 CET	38242	58516	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:23.181225061 CET	58516	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:24.089530945 CET	58518	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:24.094561100 CET	38242	58518	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:24.094618082 CET	58518	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:24.094647884 CET	58518	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:24.099608898 CET	38242	58518	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:24.600461006 CET	58518	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:24.648025036 CET	38242	58518	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:25.601598978 CET	58520	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:25.606734037 CET	38242	58520	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:25.606818914 CET	58520	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:25.606859922 CET	58520	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:25.611855030 CET	38242	58520	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:26.111378908 CET	58520	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:26.164031029 CET	38242	58520	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:26.227617979 CET	38242	58520	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:26.227698088 CET	58520	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:27.112432957 CET	58522	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:27.117665052 CET	38242	58522	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:27.117726088 CET	58522	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:27.117726088 CET	58522	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:27.122803926 CET	38242	58522	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:27.624891043 CET	58522	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:27.672060966 CET	38242	58522	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:27.758951902 CET	38242	58522	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:27.759325027 CET	58522	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:28.625754118 CET	58524	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:28.630917072 CET	38242	58524	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:28.630974054 CET	58524	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:28.630991936 CET	58524	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:28.636053085 CET	38242	58524	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:29.134135962 CET	58524	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:29.184087038 CET	38242	58524	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:30.134917974 CET	58526	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:30.139986992 CET	38242	58526	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:30.140042067 CET	58526	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:30.140064001 CET	58526	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:30.145042896 CET	38242	58526	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:30.643596888 CET	58526	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:30.696048975 CET	38242	58526	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:31.644438982 CET	58528	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:31.649655104 CET	38242	58528	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:31.649765015 CET	58528	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:31.649811029 CET	58528	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:31.654763937 CET	38242	58528	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:32.153660059 CET	58528	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:32.200166941 CET	38242	58528	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:32.285008907 CET	38242	58528	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:32.285084009 CET	58528	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:32.741770983 CET	42836	443	192.168.2.23	91.189.91.43
Mar 4, 2025 21:48:33.154866934 CET	58530	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:33.236673117 CET	38242	58530	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:33.236917019 CET	58530	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:33.236917019 CET	58530	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:33.241895914 CET	38242	58530	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:33.740842104 CET	58530	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:33.754817963 CET	38242	58518	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:33.754879951 CET	58518	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:33.788094997 CET	38242	58530	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:34.741878033 CET	58532	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:34.748158932 CET	38242	58532	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:34.748239994 CET	58532	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:34.748322010 CET	58532	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:34.754482031 CET	38242	58532	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:35.251733065 CET	58532	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:35.304095030 CET	38242	58532	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:35.356640100 CET	38242	58532	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:35.356832027 CET	58532	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:35.476063967 CET	38242	58506	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:35.476135969 CET	58506	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:36.252413988 CET	58534	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:36.257499933 CET	38242	58534	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:36.257580996 CET	58534	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:36.257592916 CET	58534	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:36.262607098 CET	38242	58534	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:36.760930061 CET	58534	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:36.808084965 CET	38242	58534	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:36.918108940 CET	38242	58534	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:36.918267965 CET	58534	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:37.762042999 CET	58536	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:37.767131090 CET	38242	58536	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:37.767216921 CET	58536	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:37.767256975 CET	58536	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:37.772321939 CET	38242	58536	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:38.271034956 CET	58536	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:38.320038080 CET	38242	58536	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:38.884983063 CET	42516	80	192.168.2.23	109.202.202.202
Mar 4, 2025 21:48:39.272027969 CET	58538	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:39.277076006 CET	38242	58538	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:39.277168036 CET	58538	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:39.277168036 CET	58538	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:39.282284021 CET	38242	58538	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:39.782769918 CET	58538	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:39.828102112 CET	38242	58538	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:40.785733938 CET	58540	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:40.790832996 CET	38242	58540	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:40.791083097 CET	58540	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:40.791083097 CET	58540	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:40.796283007 CET	38242	58540	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:41.296623945 CET	58540	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:41.344109058 CET	38242	58540	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:41.439116955 CET	38242	58540	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:41.439207077 CET	58540	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:42.297996044 CET	58542	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:42.303090096 CET	38242	58542	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:42.303256989 CET	58542	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:42.303297997 CET	58542	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:42.308374882 CET	38242	58542	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:42.812622070 CET	58542	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:42.860219002 CET	38242	58542	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:42.925726891 CET	38242	58542	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:42.925817013 CET	58542	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:43.813697100 CET	58544	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:44.836049080 CET	58544	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:44.937290907 CET	38242	58544	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:44.937416077 CET	58544	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:44.937448978 CET	58544	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:44.952593088 CET	38242	58544	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:44.952609062 CET	38242	58544	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:44.952632904 CET	58544	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:45.444226027 CET	58544	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:45.496131897 CET	38242	58544	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:46.445570946 CET	58546	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:46.450681925 CET	38242	58546	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:46.450747967 CET	58546	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:46.450907946 CET	58546	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:46.455873966 CET	38242	58546	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:46.956675053 CET	58546	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:47.008177996 CET	38242	58546	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:47.061361074 CET	38242	58546	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:47.061428070 CET	58546	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:47.435487032 CET	38242	58536	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:47.435578108 CET	58536	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:47.957532883 CET	58548	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:47.962647915 CET	38242	58548	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:47.962889910 CET	58548	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:47.962889910 CET	58548	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:47.967925072 CET	38242	58548	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:48.470266104 CET	58548	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:48.516458988 CET	38242	58548	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:49.471350908 CET	58550	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:49.478348017 CET	38242	58550	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:49.478430986 CET	58550	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:49.478430986 CET	58550	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:49.485008001 CET	38242	58550	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:49.984744072 CET	58550	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:50.019582987 CET	38242	58524	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:50.019654989 CET	58524	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:50.032080889 CET	38242	58550	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:50.984213114 CET	58552	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:50.989536047 CET	38242	58552	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:50.989593029 CET	58552	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:50.989623070 CET	58552	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:50.994641066 CET	38242	58552	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:51.496402025 CET	58552	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:51.503925085 CET	38242	58526	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:51.503979921 CET	58526	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:51.544137955 CET	38242	58552	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:51.589025021 CET	38242	58552	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:51.589179039 CET	58552	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:52.497448921 CET	58554	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:52.503180027 CET	38242	58554	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:52.503247023 CET	58554	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:52.503271103 CET	58554	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:52.508378983 CET	38242	58554	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:53.007111073 CET	58554	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:53.056051970 CET	38242	58554	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:53.148077011 CET	38242	58554	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:53.148145914 CET	58554	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:54.008536100 CET	58556	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:54.013757944 CET	38242	58556	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:54.013818979 CET	58556	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:54.013830900 CET	58556	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:54.018949032 CET	38242	58556	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:54.519673109 CET	58556	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:54.568221092 CET	38242	58556	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:54.617693901 CET	38242	58556	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:54.617939949 CET	58556	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:54.677674055 CET	38242	58530	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:54.677740097 CET	58530	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:55.521034956 CET	58558	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:55.530267954 CET	38242	58558	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:55.530411005 CET	58558	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:55.530411005 CET	58558	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:55.538558960 CET	38242	58558	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:56.037203074 CET	58558	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:56.084079981 CET	38242	58558	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:56.126990080 CET	38242	58558	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:56.127106905 CET	58558	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:57.038466930 CET	58560	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:57.045579910 CET	38242	58560	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:57.045665026 CET	58560	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:57.045705080 CET	58560	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:57.052860975 CET	38242	58560	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:57.551038980 CET	58560	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:57.588768005 CET	38242	58548	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:57.588850975 CET	58548	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:57.604126930 CET	38242	58560	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:57.685667038 CET	38242	58560	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:57.685794115 CET	58560	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:58.551815033 CET	58562	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:58.557356119 CET	38242	58562	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:58.557432890 CET	58562	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:58.557449102 CET	58562	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:58.562668085 CET	38242	58562	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:59.060863018 CET	58562	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:59.108092070 CET	38242	58562	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:59.110719919 CET	38242	58550	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:59.110805035 CET	58550	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:48:59.157900095 CET	38242	58562	176.65.134.15	192.168.2.23
Mar 4, 2025 21:48:59.157982111 CET	58562	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:00.062510014 CET	58564	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:00.067838907 CET	38242	58564	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:00.067956924 CET	58564	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:00.067956924 CET	58564	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:00.073240995 CET	38242	58564	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:00.572324038 CET	58564	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:00.620357990 CET	38242	58564	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:00.645174980 CET	38242	58538	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:00.645298958 CET	58538	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:00.681550980 CET	38242	58564	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:00.681673050 CET	58564	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:01.573736906 CET	58566	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:01.579209089 CET	38242	58566	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:01.579313040 CET	58566	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:01.579333067 CET	58566	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:01.584388018 CET	38242	58566	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:02.083638906 CET	58566	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:02.293720961 CET	58566	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:02.505691051 CET	58566	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:02.767596006 CET	38242	58566	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:02.767816067 CET	38242	58566	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:02.767919064 CET	58566	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:02.767919064 CET	58566	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:02.770566940 CET	38242	58566	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:02.770597935 CET	38242	58566	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:02.770617962 CET	58566	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:02.770647049 CET	58566	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:02.771053076 CET	38242	58566	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:02.771099091 CET	58566	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:03.085922956 CET	58568	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:03.091353893 CET	38242	58568	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:03.091489077 CET	58568	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:03.091489077 CET	58568	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:03.096864939 CET	38242	58568	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:03.457592964 CET	43928	443	192.168.2.23	91.189.91.42
Mar 4, 2025 21:49:03.597413063 CET	58568	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:03.644258022 CET	38242	58568	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:03.716825962 CET	38242	58568	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:03.717164993 CET	58568	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:04.599013090 CET	58570	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:04.604712009 CET	38242	58570	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:04.604850054 CET	58570	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:04.604891062 CET	58570	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:04.609982014 CET	38242	58570	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:05.110785007 CET	58570	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:05.156151056 CET	38242	58570	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:05.239403009 CET	38242	58570	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:05.239605904 CET	58570	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:06.112839937 CET	58572	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:06.118251085 CET	38242	58572	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:06.118490934 CET	58572	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:06.118634939 CET	58572	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:06.123656988 CET	38242	58572	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:06.349647999 CET	38242	58544	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:06.349756956 CET	58544	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:06.624950886 CET	58572	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:06.672127962 CET	38242	58572	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:06.717868090 CET	38242	58572	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:06.718198061 CET	58572	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:07.626777887 CET	58574	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:07.636068106 CET	38242	58574	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:07.636193991 CET	58574	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:07.636262894 CET	58574	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:07.641549110 CET	38242	58574	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:08.142767906 CET	58574	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:08.188139915 CET	38242	58574	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:09.144747019 CET	58576	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:09.149971962 CET	38242	58576	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:09.150064945 CET	58576	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:09.150120974 CET	58576	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:09.155169010 CET	38242	58576	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:09.659373045 CET	58576	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:09.708410978 CET	38242	58576	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:10.661824942 CET	58578	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:10.667113066 CET	38242	58578	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:10.667217970 CET	58578	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:10.667258024 CET	58578	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:10.672337055 CET	38242	58578	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:11.177725077 CET	58578	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:11.224061012 CET	38242	58578	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:12.180574894 CET	58580	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:12.186119080 CET	38242	58580	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:12.186208963 CET	58580	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:12.186269999 CET	58580	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:12.193810940 CET	38242	58580	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:12.699254990 CET	58580	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:12.748425961 CET	38242	58580	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:12.759737015 CET	38242	58576	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:12.759978056 CET	58576	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:13.701221943 CET	58582	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:13.706516981 CET	38242	58582	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:13.706620932 CET	58582	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:13.706666946 CET	58582	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:13.711714029 CET	38242	58582	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:14.212492943 CET	58582	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:14.260189056 CET	38242	58582	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:14.297981024 CET	38242	58578	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:14.298077106 CET	58578	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:14.332042933 CET	38242	58582	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:14.332138062 CET	58582	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:15.213670015 CET	58584	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:15.219109058 CET	38242	58584	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:15.219172001 CET	58584	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:15.219191074 CET	58584	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:15.224334002 CET	38242	58584	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:15.725488901 CET	58584	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:15.929615974 CET	38242	58584	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:15.929789066 CET	38242	58584	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:15.929964066 CET	58584	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:16.728214979 CET	58586	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:16.733402967 CET	38242	58586	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:16.733513117 CET	58586	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:16.733583927 CET	58586	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:16.738648891 CET	38242	58586	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:17.241862059 CET	58586	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:17.273097992 CET	38242	58574	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:17.273281097 CET	58574	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:17.288253069 CET	38242	58586	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:17.345601082 CET	38242	58586	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:17.345830917 CET	58586	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:18.243757010 CET	58588	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:18.248823881 CET	38242	58588	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:18.248899937 CET	58588	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:18.248965025 CET	58588	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:18.253918886 CET	38242	58588	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:18.755781889 CET	58588	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:18.808103085 CET	38242	58588	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:18.896375895 CET	38242	58588	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:18.896480083 CET	58588	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:19.757308960 CET	58590	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:19.762619019 CET	38242	58590	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:19.762685061 CET	58590	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:19.762701988 CET	58590	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:19.768126011 CET	38242	58590	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:20.267343998 CET	58590	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:20.320161104 CET	38242	58590	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:20.374224901 CET	38242	58590	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:20.374311924 CET	58590	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:21.269530058 CET	58592	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:21.275206089 CET	38242	58592	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:21.275345087 CET	58592	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:21.275399923 CET	58592	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:21.283144951 CET	38242	58592	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:21.783592939 CET	58592	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:21.795166016 CET	38242	58580	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:21.795442104 CET	58580	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:21.832475901 CET	38242	58592	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:21.882360935 CET	38242	58592	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:21.882535934 CET	58592	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:22.785588026 CET	58594	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:22.790740967 CET	38242	58594	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:22.790852070 CET	58594	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:22.790890932 CET	58594	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:22.795922041 CET	38242	58594	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:23.299226999 CET	58594	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:23.352792025 CET	38242	58594	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:23.431185007 CET	38242	58594	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:23.431545019 CET	58594	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:23.934747934 CET	42836	443	192.168.2.23	91.189.91.43
Mar 4, 2025 21:49:24.302697897 CET	58596	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:24.308357954 CET	38242	58596	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:24.308562040 CET	58596	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:24.308788061 CET	58596	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:24.313760042 CET	38242	58596	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:24.818840027 CET	58596	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:24.864090919 CET	38242	58596	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:24.911338091 CET	38242	58596	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:24.911550999 CET	58596	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:25.821302891 CET	58598	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:25.826395035 CET	38242	58598	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:25.826531887 CET	58598	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:25.826571941 CET	58598	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:25.831518888 CET	38242	58598	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:26.333609104 CET	58598	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:26.380235910 CET	38242	58598	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:26.453775883 CET	38242	58598	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:26.453932047 CET	58598	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:27.335311890 CET	58600	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:27.340476036 CET	38242	58600	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:27.340639114 CET	58600	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:27.340639114 CET	58600	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:27.345663071 CET	38242	58600	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:27.846874952 CET	58600	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:27.896059036 CET	38242	58600	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:27.957272053 CET	38242	58600	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:27.957468987 CET	58600	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:28.849411964 CET	58602	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:28.854537010 CET	38242	58602	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:28.854624033 CET	58602	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:28.854682922 CET	58602	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:28.859735012 CET	38242	58602	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:29.362544060 CET	58602	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:29.408096075 CET	38242	58602	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:29.482739925 CET	38242	58602	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:29.482852936 CET	58602	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:30.365987062 CET	58604	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:30.371109009 CET	38242	58604	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:30.371346951 CET	58604	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:30.371551037 CET	58604	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:30.376559019 CET	38242	58604	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:30.881521940 CET	58604	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:30.928164959 CET	38242	58604	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:31.113524914 CET	38242	58604	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:31.113663912 CET	58604	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:31.884593010 CET	58606	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:31.889741898 CET	38242	58606	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:31.890077114 CET	58606	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:31.890198946 CET	58606	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:31.895289898 CET	38242	58606	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:32.398113012 CET	58606	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:32.444098949 CET	38242	58606	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:32.555562019 CET	38242	58606	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:32.555737019 CET	58606	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:33.400376081 CET	58608	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:33.405637026 CET	38242	58608	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:33.405751944 CET	58608	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:33.405770063 CET	58608	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:33.410823107 CET	38242	58608	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:33.913387060 CET	58608	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:33.960119963 CET	38242	58608	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:34.022608995 CET	38242	58608	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:34.022736073 CET	58608	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:34.915435076 CET	58610	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:34.920614004 CET	38242	58610	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:34.920677900 CET	58610	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:34.920716047 CET	58610	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:34.925728083 CET	38242	58610	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:35.428404093 CET	58610	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:35.480043888 CET	38242	58610	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:36.430780888 CET	58612	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:36.435828924 CET	38242	58612	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:36.435900927 CET	58612	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:36.435973883 CET	58612	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:36.440908909 CET	38242	58612	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:36.944956064 CET	58612	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:36.992348909 CET	38242	58612	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:37.050928116 CET	38242	58612	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:37.051160097 CET	58612	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:37.947024107 CET	58614	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:37.953524113 CET	38242	58614	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:37.953593016 CET	58614	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:37.953624964 CET	58614	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:37.960939884 CET	38242	58614	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:38.460788012 CET	58614	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:38.508074999 CET	38242	58614	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:38.566757917 CET	38242	58614	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:38.566859961 CET	58614	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:39.464181900 CET	58616	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:39.469487906 CET	38242	58616	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:39.469865084 CET	58616	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:39.469954014 CET	58616	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:39.474965096 CET	38242	58616	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:39.980701923 CET	58616	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:40.028114080 CET	38242	58616	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:40.082207918 CET	38242	58616	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:40.082540989 CET	58616	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:40.982320070 CET	58618	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:40.988015890 CET	38242	58618	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:40.988096952 CET	58618	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:40.988096952 CET	58618	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:40.994211912 CET	38242	58618	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:41.495743990 CET	58618	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:41.548032045 CET	38242	58618	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:41.664252996 CET	38242	58618	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:41.664441109 CET	58618	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:42.497137070 CET	58620	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:42.502433062 CET	38242	58620	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:42.502500057 CET	58620	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:42.502538919 CET	58620	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:42.507581949 CET	38242	58620	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:43.007424116 CET	58620	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:43.060113907 CET	38242	58620	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:43.115607023 CET	38242	58620	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:43.115714073 CET	58620	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:44.008534908 CET	58622	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:44.013789892 CET	38242	58622	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:44.013866901 CET	58622	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:44.013922930 CET	58622	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:44.018944979 CET	38242	58622	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:44.519270897 CET	58622	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:44.572161913 CET	38242	58622	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:44.644386053 CET	38242	58622	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:44.644510031 CET	58622	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:45.520951986 CET	58624	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:45.526283026 CET	38242	58624	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:45.526416063 CET	58624	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:45.526453972 CET	58624	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:45.534945011 CET	38242	58624	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:46.031997919 CET	58624	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:46.084214926 CET	38242	58624	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:46.126108885 CET	38242	58624	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:46.126226902 CET	58624	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:47.033751965 CET	58626	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:47.038981915 CET	38242	58626	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:47.039113045 CET	58626	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:47.039151907 CET	58626	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:47.044159889 CET	38242	58626	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:47.545208931 CET	58626	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:47.592072964 CET	38242	58626	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:47.666321993 CET	38242	58626	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:47.666598082 CET	58626	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:48.546964884 CET	58628	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:48.552177906 CET	38242	58628	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:48.552295923 CET	58628	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:48.552351952 CET	58628	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:48.557396889 CET	38242	58628	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:49.058244944 CET	58628	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:49.104165077 CET	38242	58628	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:49.183873892 CET	38242	58628	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:49.184079885 CET	58628	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:50.060035944 CET	58630	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:50.065181017 CET	38242	58630	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:50.065326929 CET	58630	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:50.065361977 CET	58630	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:50.070344925 CET	38242	58630	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:50.571563005 CET	58630	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:50.620223999 CET	38242	58630	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:50.728027105 CET	38242	58630	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:50.728226900 CET	58630	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:51.572985888 CET	58632	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:51.578213930 CET	38242	58632	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:51.578326941 CET	58632	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:51.578422070 CET	58632	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:51.583444118 CET	38242	58632	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:52.083306074 CET	58632	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:52.136162043 CET	38242	58632	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:53.084877968 CET	58634	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:53.091142893 CET	38242	58634	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:53.091269970 CET	58634	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:53.091294050 CET	58634	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:53.096868992 CET	38242	58634	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:53.597544909 CET	58634	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:53.644134045 CET	38242	58634	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:53.725316048 CET	38242	58634	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:53.725518942 CET	58634	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:54.598939896 CET	58636	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:54.604155064 CET	38242	58636	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:54.604245901 CET	58636	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:54.604285002 CET	58636	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:54.609361887 CET	38242	58636	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:55.109325886 CET	58636	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:55.160100937 CET	38242	58636	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:55.246205091 CET	38242	58636	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:55.246301889 CET	58636	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:56.110614061 CET	58638	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:56.115715027 CET	38242	58638	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:56.115833998 CET	58638	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:56.115845919 CET	58638	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:56.120832920 CET	38242	58638	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:56.303714037 CET	38242	58610	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:56.303812981 CET	58610	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:56.623054981 CET	58638	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:56.672126055 CET	38242	58638	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:56.728648901 CET	38242	58638	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:56.728733063 CET	58638	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:57.624401093 CET	58640	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:57.629503965 CET	38242	58640	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:57.629565954 CET	58640	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:57.629698038 CET	58640	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:57.634747982 CET	38242	58640	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:58.134747028 CET	58640	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:58.180179119 CET	38242	58640	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:58.240968943 CET	38242	58640	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:58.242160082 CET	58640	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:59.137682915 CET	58642	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:59.142831087 CET	38242	58642	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:59.143156052 CET	58642	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:59.143273115 CET	58642	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:59.148294926 CET	38242	58642	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:59.650679111 CET	58642	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:49:59.704057932 CET	38242	58642	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:59.745313883 CET	38242	58642	176.65.134.15	192.168.2.23
Mar 4, 2025 21:49:59.745415926 CET	58642	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:00.652512074 CET	58644	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:00.657983065 CET	38242	58644	176.65.134.15	192.168.2.23
Mar 4, 2025 21:50:00.658062935 CET	58644	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:00.658128023 CET	58644	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:00.663089991 CET	38242	58644	176.65.134.15	192.168.2.23
Mar 4, 2025 21:50:01.165970087 CET	58644	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:01.182760000 CET	38242	58632	176.65.134.15	192.168.2.23
Mar 4, 2025 21:50:01.182838917 CET	58632	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:01.212369919 CET	38242	58644	176.65.134.15	192.168.2.23
Mar 4, 2025 21:50:01.253843069 CET	38242	58644	176.65.134.15	192.168.2.23
Mar 4, 2025 21:50:01.254029989 CET	58644	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:02.168003082 CET	58646	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:02.173141956 CET	38242	58646	176.65.134.15	192.168.2.23
Mar 4, 2025 21:50:02.173234940 CET	58646	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:02.173304081 CET	58646	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:02.178286076 CET	38242	58646	176.65.134.15	192.168.2.23
Mar 4, 2025 21:50:02.680018902 CET	58646	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:02.728053093 CET	38242	58646	176.65.134.15	192.168.2.23
Mar 4, 2025 21:50:02.795530081 CET	38242	58646	176.65.134.15	192.168.2.23
Mar 4, 2025 21:50:02.795681953 CET	58646	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:03.681540966 CET	58648	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:03.687125921 CET	38242	58648	176.65.134.15	192.168.2.23
Mar 4, 2025 21:50:03.687233925 CET	58648	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:03.687272072 CET	58648	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:03.692472935 CET	38242	58648	176.65.134.15	192.168.2.23
Mar 4, 2025 21:50:04.193785906 CET	58648	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:04.240251064 CET	38242	58648	176.65.134.15	192.168.2.23
Mar 4, 2025 21:50:05.195579052 CET	58650	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:05.200804949 CET	38242	58650	176.65.134.15	192.168.2.23
Mar 4, 2025 21:50:05.200898886 CET	58650	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:05.200957060 CET	58650	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:05.205972910 CET	38242	58650	176.65.134.15	192.168.2.23
Mar 4, 2025 21:50:05.710635900 CET	58650	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:05.760085106 CET	38242	58650	176.65.134.15	192.168.2.23
Mar 4, 2025 21:50:05.828525066 CET	38242	58650	176.65.134.15	192.168.2.23
Mar 4, 2025 21:50:05.828802109 CET	58650	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:06.712460041 CET	58652	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:06.717665911 CET	38242	58652	176.65.134.15	192.168.2.23
Mar 4, 2025 21:50:06.717756033 CET	58652	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:06.717789888 CET	58652	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:06.722798109 CET	38242	58652	176.65.134.15	192.168.2.23
Mar 4, 2025 21:50:07.225665092 CET	58652	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:07.276165962 CET	38242	58652	176.65.134.15	192.168.2.23
Mar 4, 2025 21:50:08.227374077 CET	58654	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:08.232566118 CET	38242	58654	176.65.134.15	192.168.2.23
Mar 4, 2025 21:50:08.232664108 CET	58654	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:08.232686043 CET	58654	38242	192.168.2.23	176.65.134.15
Mar 4, 2025 21:50:08.237770081 CET	38242	58654	176.65.134.15	192.168.2.23

System Behavior

Analysis Process: mips.nn.elf PID: 6242, Parent PID: 6159

General

Start time (UTC):	20:48:01
Start date (UTC):	04/03/2025
Path:	/tmp/mips.nn.elf
Arguments:	/tmp/mips.nn.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

File Activities

File Opened

File Deleted

File Read

File Written

Directory Enumerated

Symbolic Link Created

Process Activities

Process Forked

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Listening

Socket Connecting

Chronological Activities

Analysis Process: mips.nn.elf PID: 6264, Parent PID: 6242

General

Start time (UTC):	20:48:02
Start date (UTC):	04/03/2025
Path:	/tmp/mips.nn.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Process Activities

Process Forked

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: mips.nn.elf PID: 6266, Parent PID: 6264

General

Start time (UTC):	20:48:02
Start date (UTC):	04/03/2025
Path:	/tmp/mips.nn.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Prctl Requested

Thread Sleep

Chronological Activities

Analysis Process: udisksd PID: 6252, Parent PID: 799

General

Start time (UTC):	20:48:01
Start date (UTC):	04/03/2025
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: dumpe2fs PID: 6252, Parent PID: 799

General

Start time (UTC):	20:48:01
Start date (UTC):	04/03/2025
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

File Activities

File Opened

File Read

Process Activities

Prctl Requested

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: udisksd PID: 6288, Parent PID: 799

General

Start time (UTC):	20:48:02
Start date (UTC):	04/03/2025
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: dumpe2fs PID: 6288, Parent PID: 799

General

Start time (UTC):	20:48:02
Start date (UTC):	04/03/2025
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report mips.nn.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/etc/motd

/tmp/qemu-open.m5VCha (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: mips.nn.elf PID: 6242, Parent PID: 6159

General

File Activities

File Opened

File Deleted

File Read

File Written

Directory Enumerated

Symbolic Link Created

Process Activities

Process Forked

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Listening

Socket Connecting

Chronological Activities

Analysis Process: mips.nn.elf PID: 6264, Parent PID: 6242

Linux Analysis Report
mips.nn.elf